We have published a note to provide our clients a summary regarding several amendments published on September 09, 2021, in the Official Gazette of the Federation concerning the General Provisions referred to in articles 115 of the Financial Institutions Law in connection with article 87-D of the General Law of Auxiliary Credit Organizations and Activities and 95-bis of such law, applicable to multiple-purpose financial companies. (the “GP”).
Background
- Mexico has been an active member of the Financial Action Task Force (“FATF”) since 2000, which sets international standards for preventing and fighting money laundering and terrorist financing.
- In 2019, an amendment to the GP was made in order to address certain FATF recommendations, establishing a non-face-to-face identification regime by means of which a multiple-purpose financial company (“MPFC”) could carry out the identification of clients through a videoconference in real time when regulated and, in the case of an unregulated MPFC, via online. These regimes were incorporated with the purpose of identifying possible scenarios in which such entities could be used to carry out operations with resources of illicit origin and financing of terrorism.
- Due to the pandemic caused by SARS-CoV2, in compliance with the sanitary measures declared by the Mexican Federal Government, there has been a massive closing of branches pertaining to several financial institutions.
- Although the MPFC have had a non-face-to-face identification regime since March 2019, it was not possible to mitigate the risks of transactions with resources of illicit origin and financing of terrorism.
- In this regard, following new FATF recommendations, the Mexican government amends the GP with the purpose of strengthening the legislation by regulating the use of new technologies and enabling the MPFC to comply with their obligations related to the prevention of operations with resources of illicit origin and financing of terrorism.
The main aspects of the GP are the following:
1. Article 4 ter of the GP is amended establishing that, for the non-face-to-face identification of clients, in addition to the identification data referred to in Article 4, if applicable, the geolocation of the device from which the clients enter into a loan agreement with the MPFC must be requested and obtained, as well as:
a) Regarding customers who identify themselves as individuals of Mexican nationality:
i) Their consent that may be obtained by means of electronic signature or advanced electronic signature. Said consent shall be evidence to legally attest the execution of the agreement that the client may enter into with the MPFC in a non-face-to-face manner.
ii) Standardized bank code of an account opened in any MPFC, or foreign financial entity authorized to receive deposits.
iii) A statement issued by the individual establishing that he/she is acting on his/her own account.
iv) The digital version of the valid official personal identification document from which the data provided is obtained.
v) The digital version of the document used to prove the domicile.
vi) Information that may be required pursuant to Schedule 2 of the GP.
b) Regarding customers who identify themselves as entities of Mexican nationality:
i) E-mail address.
ii) Standardized bank code of an account opened in any MPFC, or foreign financial entity authorized to receive deposits.
iii) Their consent that may be obtained by means of electronic signature or advanced electronic signature of the legal representative of the entity. Said consent shall be evidence to legally attest the execution of the agreement entered into with the MPFC in a non-face-to-face manner.
iv) The information established to in Article 4, section II, paragraph c) and section VI of the GP.
v) The digital version of the identification documents referred to in Article 4, section II, paragraph b) of the GP, with the exception of those indicated in numeral ii of the same paragraph.
vi) Such information as may be required pursuant to Annex 2 of the GP.
2. The MPFC shall not carry out the execution of the agreement in a non-face-to-face manner with the clients, when they do not collect the data related to their geolocation.
3. Pursuant to Article 2 of the Schedule 2, the MPFC shall observe the following thresholds pursuant to the type of technological identification mechanism and product. In this regard, the MPFC shall have to request the corresponding authorization from the National Banking and Securities Commission (“NBSC”) for the use of such mechanism, in order to comply with Article 4 Ter of the GP.
a) When identifying Mexican individuals, individuals with business activity or legal entities, that do not have real estate collateral, by means of a video containing image and sound, for the non-face-to-face execution of loan agreements, it must be agreed that the credit line may not exceed 30,000 (thirty thousand) Investment Units.
Additionally, during the development of the technological identification mechanism referred to in the preceding paragraph, the MPFC must comply with the following:
- Record the time and date of the video, obtained from a protected time server.
- Implement it through automated tools that allow its recording and subsequent reproduction.
- Verify that the quality of the image and sound allows the full identification of the client, according to the parameters established for such purpose.
- Request the client to show a valid identification document and the corresponding format pursuant with Schedule 2 of the GP.
- Use specialized technology that allows a reliable identification of the client, ensuring that there is a match between his face and that of the valid identification document previously sent.
- Carry out a life test on the client during the implementation of the technological identification mechanism.
b) When identifying Mexican individuals, individuals with business activity or legal entities, that do not have real estate collateral, through their biometric information obtained through a governmental authority, for the non-face-to-face execution of loan agreements, it must be agreed that the credit line may not exceed 60,000 (sixty thousand) Investment Units.
In the event that the client’s fingerprints are used directly, the MPFC must ensure: i) that the fingerprint is obtained directly from the client by means of a live fingerprint test, avoiding the registration of prints coming from impressions on some material that pretends to simulate the fingerprint of another person or images that pursue such purpose; ii) have security measures that guarantee that the information stored, processed or sent through such means is not known or used by unauthorized third parties; and iii) authenticate that the fingerprint obtained from the applicant matches at least ninety percent with the records found in the databases of either the National Electoral Institute, the Ministry of Foreign Affairs or any other Mexican authority that provides a biometric information verification services.
Additionally, the MPFC must have the technology allowing the identification of the client by means of a video with image and sound.
4. The MPFC may elect to use one or both of the technological identification mechanisms mentioned in a) and b) above.
5. In the event that the aforementioned thresholds are respected and the identification mechanism mentioned in paragraph b) is used, the MPFC will not require authorization from the NBSC for the identification of clients through technological means; however, pursuant to Article 7 of Annex 2, the MPFC must collect additional information such as: i) a statement from the applicant as to whether or not it is an active client of the MPFC; and ii) the completion of forms which shall include the client’s identification data.
The MPFC must keep all information and supporting documentation, which must be available to the NBSC when required and within the term established by it.
A PDF file of this Note is available here
Author
Rodrigo de los Ríos Gordoa (partner) and José Mayagoitia y de Rosenzweig (associate).
This client alert does not constitute legal advice and is protected under copyright laws.