Is a bank, in Mexico

Disposiciones de carácter general aplicables a las instituciones de crédito, art. 168 Bis 16 · Read the law's page

• This binds a credit institution regulated by the Comisión Nacional Bancaria y de Valores (CNBV) general provisions for credit institutions (reached by declaring that you are a bank or supply software to one).
• Make sure the Commission is told immediately of an information security incident, by email to its cybersecurity account or by other means it indicates, generating an electronic receipt and stating at least the start date and time, whether it continues or has ended and its duration, a description and an initial assessment of impact or gravity (article 168 Bis 16, section I).
• Report immediately an incident that causes economic, data or service loss, whose method of operation, including exploited vulnerabilities, can be replicated at other institutions, that can affect clients or the stability of the financial or payment system, or that you consider serious (article 168 Bis 16, section I).
• Within 5 business days of identifying the incident, send the Commission the information in Annexes 64 and 64 Bis (article 168 Bis 16, section I).
• Investigate the causes immediately and send the Commission a work plan to eliminate or mitigate the risks and vulnerabilities behind the incident, naming the responsible staff, deadlines and resources, no later than 15 business days after the incident ends (article 168 Bis 16, section II).
• Where sensitive information in your custody or your service providers' custody was extracted, lost, deleted or altered, or you suspect unauthorized access, notify the affected clients within 48 hours of the incident or of learning of it (article 168 Bis 16, section II).

Disposiciones de carácter general aplicables a las instituciones de crédito, arts. 168 Bis 11 and 168 Bis 12 · Read the law's page

• This binds a credit institution regulated by the Comisión Nacional Bancaria y de Valores (CNBV) general provisions for credit institutions (reached by declaring that you are a bank or supply software to one). The text pinned here is the one the CNBV inserted as Section Eight Bis, "De la seguridad de la información".
• Have your general director make sure information security incidents are handled through management processes covering detection, classification, containment, investigation, forensic analysis where applicable, escalation, resolution, follow-up and communication to authorities, clients and counterparties (article 168 Bis 11, section IX).
• Run security reviews of the technological infrastructure at least once a year, or sooner if the infrastructure changes significantly (article 168 Bis 12, section II).
• Keep an annual calendar of vulnerability-scanning tests of the infrastructure components that store, process or transmit information, reviewing some components each quarter so that every component holding critical information is covered within the year (article 168 Bis 12, section III).
• Hire an independent third party with certified technical staff to run penetration tests on your systems and applications (article 168 Bis 12, section IV).

LRITF, art. 76 (open finance interfaces) · Read the law's page

• If you are a financial entity, money transmitter, credit information company, clearing house, financial technology institution or company authorized to operate with novel models, establish standardized application programming interfaces that let your interfaces connect with other such entities and with specialized information technology third parties, to share open financial data, aggregated data and transactional data (art. 76).
• Share transactional data, which are the clients' personal data, only with the client's prior express authorization, and use the information shared only for the purposes the client strictly authorized (art. 76).
• Interrupt access to client information as soon as the client withdraws consent, vulnerabilities put the information at risk, or the third party breaches the agreed terms, and notify the supervisory commission or Banco de México of the interruption within two hours of detecting it (art. 76).
• If you are a third party seeking access through the interfaces, obtain the prior authorization of the supervisory commission or, for credit information companies and clearing houses, Banco de México (art. 76).
• Register with the supervisory commission or Banco de México the consideration you charge for the data exchange, at least thirty calendar days before a new or increased charge takes effect (art. 76).

LRSIC, art. 28 (signed authorization for disclosure) · Read the law's page

• If you are a credit information company, give information to a user only when the client has given express authorization by signature, stating that the client knows the nature and scope of the information, the use the user will make of it, and that the user may run periodic checks of the credit history while the legal relationship lasts (art. 28).
• Collect the client's signature by hand or electronically on the terms Banco de México sets, and obtain the authorization for individuals and for legal entities with total credits under 400,000 UDIS (art. 28).
• If you are a user, do not rely on an authorization beyond one year from its grant, or up to two further years if the client expressly agrees, except for as long as a legal relationship with the client lasts (art. 28).
• Put an authorization text that forms part of the paperwork for a service in a special section, with the client's handwritten signature as an additional signature (art. 28).
• Do not supply a client's personal data to a user or any third party for marketing products or services, except for credit-history queries (art. 28).

LRSIC, art. 6 (authorization to operate) · Read the law's page

• Do not incorporate or operate as a credit information company without the authorization of the Federal Government, which the Secretaría de Hacienda y Crédito Público grants after hearing Banco de México and the Comisión Nacional Bancaria y de Valores, and which cannot be transferred (art. 6).

LRSIC, arts. 40-42 (special credit report and claims) · Read the law's page

• If you are a credit information company, formulate the Special Credit Report a client requests in clear, complete and accessible form, and send it or make it available within five business days of receiving the request, at the client's choice at your specialized unit, by email, or in a sealed envelope with acknowledgement of receipt (art. 40).
• Send a client the Special Credit Report free of charge each time twelve months have passed, when the client asks for delivery by email or collects it at your specialized unit (art. 41).
• Keep a free telephone number and a website available for continuous consultation to take Special Credit Report requests and clients' claims, and answer clients' questions about them (art. 40).
• Accept a client's claim about the information in a Credit Report or Special Credit Report in writing, by mail, internet, telephone or email, record claims made by telephone, and give the client a control number to follow the claim (art. 42).
• If you are a financial entity, Sofome E.N.R. or commercial company that supplies or queries credit information, process the Special Credit Report requests clients present through your specialized unit or the persons you designate, and tell clients the free telephone number (art. 40).