MexicoCNBV and Banco de México Provisions for Electronic Payment Funds Institutions, Information Security Incident Reporting
Disposiciones aplicables a las instituciones de fondos de pago electrónico a que se refieren los artículos 48 segundo párrafo; 54, primer párrafo, y 56, primer y segundo párrafos de la Ley para Regular las Instituciones de Tecnología Financiera, art. 42
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds an institución de fondos de pago electrónico (electronic payment funds institution) under the Ley para Regular las Instituciones de Tecnología Financiera (reached by declaring that you are a payment provider). The provisions apply from , ninety calendar days after their publication on .
- Make sure Banco de México and the CNBV are told immediately of an information security incident, by email to their designated accounts or by other means they indicate, stating at least the start date and time, whether it continues or has ended and its duration, a description and an initial assessment of impact or gravity (article 42, section I).
- Within five business days of identifying the incident, send Banco de México and the CNBV the information required by Annexes 3 and 4 (article 42, section I).
- Investigate the causes immediately and send Banco de México and the CNBV a work plan to eliminate or mitigate the vulnerabilities behind the incident, naming the responsible staff, deadlines and resources, no later than fifteen business days after the incident ends (article 42, section II).
- Where personal or sensitive information in your custody or your service providers' custody was extracted, lost, deleted or altered, or you suspect unauthorized access, notify the affected clients within twenty-four hours of the incident or of learning of it (article 42, section III).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Comisión Nacional Bancaria y de Valores, which fines infractions of the general provisions it issues alone or jointly with Banco de México that carry no more specific sanction (article 103, section XIV of the Ley para Regular las Instituciones de Tecnología Financiera).
Settledness
- As of
- Open questions
- Does the Commission or Banco de México apply a more specific fine than article 103, section XIV to a failure to report an incident?
What this law does
The provisions were published in the Diario Oficial de la Federación on . The provisions enter into force ninety calendar days after their publication. Article 42, section I of the provisions requires the general director or sole administrator to make arrangements so that Banco de México and the CNBV are told of information security incidents immediately, by email to designated accounts or other means they indicate.
Article 42, section I also requires the institution to send the information in Annexes 3 and 4 within five business days of identifying the incident. Article 42, section II requires an immediate investigation of the causes and a work plan sent to Banco de México and the CNBV within fifteen business days after the incident ends.
Where personal or sensitive information in the custody of the institution or its service providers was extracted, lost, deleted or altered, or unauthorized access is suspected, article 42, section III requires clients to be notified within twenty-four hours of the incident or of learning of it.
Article 56 of the Ley para Regular las Instituciones de Tecnología Financiera makes the use of electronic means and authentication subject to general provisions that the CNBV and Banco de México issue jointly for electronic payment funds institutions. Infractions of general provisions the CNBV issues alone or jointly with Banco de México that carry no specific sanction are fined 2,000 to 10,000 UMA under article 103, section XIV of that law.
When LexLint raises it
When your app profile says your app is a payment provider.