On Thursday, September 9, the resolutions that reform, add and repeal the general rules on the prevention and identification of operations with resources of illicit origin applicable to financial cooperative associations (sociedades financieras populares), savings and credit cooperatives (sociedades cooperativas de ahorro y préstamo), multiple purposes financial entities (sociedades financieras de objeto múltiple), brokerage firms (casas de bolsa), investment fund operators (sociedades operadoras de fondos de inversión) and investment fund distribution companies (sociedades distribuidoras de acciones de fondos de inversión) (the "Resolutions") were published in the Federal Official Gazette.
The Resolutions were issued based on the Guidance on Digital Identity of the Financial Action Task Force ("FATF"), issued on March 2020. One of the main objectives of the Resolutions is to recognize the legal possibility that certain financial institutions may apply for authorization from the National Banking and Securities Commission (the "Commission") in order to execute agreements remotely through new technologies while fulfilling their obligations toward the prevention of operations with resources of illicit origin and financing of terrorism.
Two thresholds, two identification procedures
Except for the brokerage firms, the investment fund operators and the investment fund distribution companies, for which there is only one threshold, the Resolutions establish two different procedures for the remote identification of clients who are individuals, individuals with business activities or legal entities—all of Mexican nationality—which are determined according to the transactional level of each applicant in comparison with a lower threshold and another upper threshold. These thresholds seek to have financial institutions apply risk-based measures to digital identification procedures, in accordance with Recommendation 1 of the FATF.
Before the issuance of the Resolutions, financial institutions were already able to apply remote identification measures—specially for individuals of Mexican nationality—after authorization of the Commission. However, the Resolutions simplify the identification of legal entities and individuals with business activities, taking into account the transactional risk for the financial institutions subject to the reform.
Transactional level below the lower threshold
For applicants whose transactional level remains below the lower threshold, depending on the type of institution,1 the corresponding institution shall have technology to identify the applicant by means of a recording with image and sound, which shall be kept without editing in its full duration for the entire duration of the account or the contract and, once it is concluded, for a period of at least ten years after the termination of the opening of the account or the contractual relationship.
In addition, during the development of the identification process referred to in the preceding paragraph, the financial institutions shall comply with the following:
- Record the time and date of the process obtained from a protected timeserver
- Implement it through automated tools that allow recording and playback
- Verify that the quality of the image and sound allow full identification of the applicant, according to the standards established by the financial institutions for such purposes
- Ask the applicant to show the valid ID sent as part of his file, on both sides, validating that it has the same data and photograph as the valid ID previously sent
- Use specialized technology that allows them to obtain reliable identification of the applicant, ensuring that there is a match between the applicant’s face and the one in the valid ID previously sent
- Perform a life test on the applicant
Transactional level between the lower threshold and the upper threshold
For applicants whose transactional level is between the lower threshold and the upper threshold, depending on the type of institution,2 the corresponding institution shall have, in addition to the abovementioned technology for the identification of the client, the measures that allow the verification of the match between the biometric data of the applicant and the records of the National Electoral Institute (Instituto Nacional Electoral), the Ministry of Foreign Affairs (Secretaría de Relaciones Exteriores) or any other Mexican authority that provides a biometric data
validation service.
If the biometric data used are fingerprints, the financial institutions shall verify that their applications or electronic means ensure that the fingerprint is obtained directly from the applicant; i.e., a live print testing, avoiding the registration of fingerprints from prints on material intended to simulate another person’s imprint, or images that pursue this purpose. They shall also have security measures to ensure that the information stored, processed or sent through such applications or electronic means is not disclosed or used by unauthorized third parties and authenticates that the fingerprint obtained from the applicant matches by at least 90 percent with the records of the databases of the National Electoral Institute, the Ministry of Foreign Affairs or with those of some other Mexican authority that provides a biometric data validation service.
Transactional level above the upper threshold
Financial institutions shall not use remote identification mechanisms for applicants whose transactional level is above the upper threshold. In this case, the financial institutions shall conduct face-to-face interviews and integrate the identification file of the corresponding clients with all the relevant information and documentation, in terms of the applicable provisions.
Enforceability and Application
In accordance with the transitory articles of the Resolutions, the financial institutions that have obtained the Commission’s approval for their remote identification mechanisms before the Resolutions became enforceable shall have a 12-month period, starting from the day after the issuance of the Resolutions, to submit to the Commission a new application in accordance with the mechanisms implemented under the Resolutions.
In addition, in accordance with the Resolutions, no authorization from the Commission shall be required to use remote identification mechanisms if the financial entities are under the lower threshold and validate that the biometric data of the applicant matches with the records of the databases of the National Electoral Institute, the Ministry of Foreign Affairs or with those of some other Mexican authority that provides a biometric data validation service.
Likewise, financial institutions must comply with the obligations contained in the Resolutions, in the terms and in accordance with the deadlines set out below:
- Four months from the day after the issuance of the Resolutions, amend their Compliance Manual and submit it to the Commission
- Nine months from the day after the issuance of the Resolutions, modify their Risk-Based Methodologies
- Eighteen months from the day after the issuance of the Resolutions, update their automated systems
Brokerage firms, investment fund operators and investment fund distribution companies shall have six months from the day after the issuance of the Resolutions to obtain the latitude and longitude geographic coordinates based on the pairing of the Internet protocol address provided by the client’s device with a geographic location for obtaining the approximate coordinates, in the event that clients carry out remote transactions from a device that, due its characteristics, cannot provide the latitude and longitude geographic coordinates through the Global Positioning System ("GPS").
Conclusion
The Resolutions seek to facilitate the identification of clients of several financial institutions based on the Recommendations of the FATF. However, financial institutions shall adapt their Compliance Manual, their Risk-Based Methodologies, as well as their risk analysis on money laundering and financing of terrorism in order to properly implement the measures discussed in this document.
Click here to download 'Mexico’s CNBV updates remote contracting requirements' (Spanish)
1 For the execution of contracts with applicants who are individuals, individuals with business activities or legal entities, all of Mexican nationality, the following lower thresholds shall be considered: (i) for brokerage firms, the sum of the transactions shall not exceed the equivalent in Mexican currency of 30,000 Investment Units during a calendar month; (ii) for investment funds operators and investment funds’ distribution companies, the sum of the transactions shall not exceed the equivalent in Mexican currency of 30,000 Investment Units during a calendar month; (iii) for financial cooperative associations, the sum of deposits in deposit accounts shall not exceed the equivalent in Mexican currency of 30,000 Investment Units during a calendar month, and the consumer credits offered shall not exceed the equivalent in Mexican currency of 60,000 Investment Units; (iv) for savings and credit cooperatives, the sum of deposits in deposit accounts shall not exceed the equivalent in Mexican currency of 30,000 Investment Units during a calendar month, and the consumer credits offered shall not exceed the equivalent in Mexican currency of 60,000 Investment Units; and (v) for multiple purpose financial entities, not regulated, the credit line of contracts without mortgages shall not exceed the equivalent in Mexican currency of 30,000 Investment Units.
2 For the execution of contracts with applicants who are individuals, individuals with business activities or legal entities, all of Mexican nationality, the following upper thresholds shall be considered: (i) for brokerage firms, the sum of the transactions that exceed the equivalent in Mexican currency of 30,000 Investment Units during a calendar month’ (ii) for investment fund operators and investment funds’ distribution companies, the sum of the transactions that exceed the equivalent in Mexican currency of 30,000 Investment Units during a calendar month; (iii) for financial cooperative associations, the sum of deposits in deposit accounts shall not exceed the equivalent in Mexican currency of 60,000 Investment Units during a calendar month, and the consumer credits offered shall not exceed the equivalent in Mexican currency of 100,000 Investment Units; (iv) for savings and credit cooperatives, the sum of deposits in deposit accounts shall not exceed the equivalent in Mexican currency of 60,000 Investment Units during a calendar month, and the consumer credits offered shall not exceed the equivalent in Mexican currency of 100,000 Investment Units; and (v) for multiple purpose financial entities, not regulated, the credit line of contracts without mortgages shall not exceed the equivalent in Mexican currency of 60,000 Investment Units.
Viridiana Alanis (White & Case, Legal intern, Mexico City) contributed to the development of this publication.
White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.
This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.
© 2021 White & Case LLP
