Is a payment provider, in Mexico

Disposiciones aplicables a las instituciones de fondos de pago electrónico a que se refieren los artículos 48, segundo párrafo; 54, primer párrafo, y 56, primer y segundo párrafos de la Ley para Regular las Instituciones de Tecnología Financiera, art. 42 · Read the law's page

• This binds an institución de fondos de pago electrónico (electronic payment funds institution) under the Ley para Regular las Instituciones de Tecnología Financiera (reached by declaring that you are a payment provider). The provisions apply from 28 April 2021, ninety calendar days after their publication on 28 January 2021.
• Make sure Banco de México and the CNBV are told immediately of an information security incident, by email to their designated accounts or by other means they indicate, stating at least the start date and time, whether it continues or has ended and its duration, a description and an initial assessment of impact or gravity (article 42, section I).
• Within five business days of identifying the incident, send Banco de México and the CNBV the information required by Annexes 3 and 4 (article 42, section I).
• Investigate the causes immediately and send Banco de México and the CNBV a work plan to eliminate or mitigate the vulnerabilities behind the incident, naming the responsible staff, deadlines and resources, no later than fifteen business days after the incident ends (article 42, section II).
• Where personal or sensitive information in your custody or your service providers' custody was extracted, lost, deleted or altered, or you suspect unauthorized access, notify the affected clients within twenty-four hours of the incident or of learning of it (article 42, section III).

Disposiciones aplicables a las instituciones de fondos de pago electrónico a que se refieren los artículos 48, segundo párrafo; 54, primer párrafo, y 56, primer y segundo párrafos de la Ley para Regular las Instituciones de Tecnología Financiera, arts. 31, 33, 34 and 35 · Read the law's page

• This binds an institución de fondos de pago electrónico (electronic payment funds institution) under the Ley para Regular las Instituciones de Tecnología Financiera (reached by declaring that you are a payment provider). The provisions apply from 28 April 2021, ninety calendar days after their publication on 28 January 2021.
• Have a Plan Director de Seguridad (security master plan) approved by your general director or sole administrator, aligned with your business strategy and your continuity and information security policy (article 31).
• Evaluate or audit the security of your technological infrastructure at least once a year and before starting operations, and give your administrative body a report of the level of information risk, a remediation plan for the high and very high findings, and evidence of remediation and mitigation (article 33).
• Hire a legal entity with certified technical staff to run penetration tests on your systems and applications at least every two years (article 34).
• Have a chief information security officer, who may be a third party, designated by your general director or sole administrator and free of conflicts of interest with your audit and information technology functions (article 35).

LRITF, art. 76 (open finance interfaces) · Read the law's page

• If you are a financial entity, money transmitter, credit information company, clearing house, financial technology institution or company authorized to operate with novel models, establish standardized application programming interfaces that let your interfaces connect with other such entities and with specialized information technology third parties, to share open financial data, aggregated data and transactional data (art. 76).
• Share transactional data, which are the clients' personal data, only with the client's prior express authorization, and use the information shared only for the purposes the client strictly authorized (art. 76).
• Interrupt access to client information as soon as the client withdraws consent, vulnerabilities put the information at risk, or the third party breaches the agreed terms, and notify the supervisory commission or Banco de México of the interruption within two hours of detecting it (art. 76).
• If you are a third party seeking access through the interfaces, obtain the prior authorization of the supervisory commission or, for credit information companies and clearing houses, Banco de México (art. 76).
• Register with the supervisory commission or Banco de México the consideration you charge for the data exchange, at least thirty calendar days before a new or increased charge takes effect (art. 76).

LRSIC, art. 28 (signed authorization for disclosure) · Read the law's page

• If you are a credit information company, give information to a user only when the client has given express authorization by signature, stating that the client knows the nature and scope of the information, the use the user will make of it, and that the user may run periodic checks of the credit history while the legal relationship lasts (art. 28).
• Collect the client's signature by hand or electronically on the terms Banco de México sets, and obtain the authorization for individuals and for legal entities with total credits under 400,000 UDIS (art. 28).
• If you are a user, do not rely on an authorization beyond one year from its grant, or up to two further years if the client expressly agrees, except for as long as a legal relationship with the client lasts (art. 28).
• Put an authorization text that forms part of the paperwork for a service in a special section, with the client's handwritten signature as an additional signature (art. 28).
• Do not supply a client's personal data to a user or any third party for marketing products or services, except for credit-history queries (art. 28).

LRSIC, art. 6 (authorization to operate) · Read the law's page

• Do not incorporate or operate as a credit information company without the authorization of the Federal Government, which the Secretaría de Hacienda y Crédito Público grants after hearing Banco de México and the Comisión Nacional Bancaria y de Valores, and which cannot be transferred (art. 6).

LRSIC, arts. 40-42 (special credit report and claims) · Read the law's page

• If you are a credit information company, formulate the Special Credit Report a client requests in clear, complete and accessible form, and send it or make it available within five business days of receiving the request, at the client's choice at your specialized unit, by email, or in a sealed envelope with acknowledgement of receipt (art. 40).
• Send a client the Special Credit Report free of charge each time twelve months have passed, when the client asks for delivery by email or collects it at your specialized unit (art. 41).
• Keep a free telephone number and a website available for continuous consultation to take Special Credit Report requests and clients' claims, and answer clients' questions about them (art. 40).
• Accept a client's claim about the information in a Credit Report or Special Credit Report in writing, by mail, internet, telephone or email, record claims made by telephone, and give the client a control number to follow the claim (art. 42).
• If you are a financial entity, Sofome E.N.R. or commercial company that supplies or queries credit information, process the Special Credit Report requests clients present through your specialized unit or the persons you designate, and tell clients the free telephone number (art. 40).