MexicoCNBV and Banco de México Provisions for Electronic Payment Funds Institutions, Information Security Programme
Disposiciones aplicables a las instituciones de fondos de pago electrónico a que se refieren los artículos 48 segundo párrafo; 54, primer párrafo, y 56, primer y segundo párrafos de la Ley para Regular las Instituciones de Tecnología Financiera, arts. 31, 33, 34 and 35
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- This binds an institución de fondos de pago electrónico (electronic payment funds institution) under the Ley para Regular las Instituciones de Tecnología Financiera (reached by declaring that you are a payment provider). The provisions apply from , ninety calendar days after their publication on .
- Have a Plan Director de Seguridad (security master plan) approved by your general director or sole administrator, aligned with your business strategy and your continuity and information security policy (article 31).
- Evaluate or audit the security of your technological infrastructure at least once a year and before starting operations, and give your administrative body a report of the level of information risk, a remediation plan for the high and very high findings, and evidence of remediation and mitigation (article 33).
- Hire a legal entity with certified technical staff to run penetration tests on your systems and applications at least every two years (article 34).
- Have a chief information security officer, who may be a third party, designated by your general director or sole administrator and free of conflicts of interest with your audit and information technology functions (article 35).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Comisión Nacional Bancaria y de Valores, which fines infractions of the general provisions it issues alone or jointly with Banco de México that carry no more specific sanction (article 103, section XIV of the Ley para Regular las Instituciones de Tecnología Financiera).
Settledness
- As of
- Open questions
- Does the Commission or Banco de México apply a more specific fine than article 103, section XIV to a breach of the information security articles?
What this law does
The provisions were published in the Diario Oficial de la Federación on . The provisions enter into force ninety calendar days after their publication. Article 31 of the provisions requires an electronic payment funds institution to have a Plan Director de Seguridad approved by its general director or sole administrator. Article 33 of the provisions requires an evaluation or audit of the security of the technological infrastructure at least once a year.
Article 34 of the provisions requires the institution to hire a legal entity with certified technical staff to run penetration tests on its systems and applications at least every two years. Article 35 of the provisions requires the institution to have a chief information security officer.
Article 56 of the Ley para Regular las Instituciones de Tecnología Financiera makes the use of electronic means and authentication subject to general provisions that the CNBV and Banco de México issue jointly for electronic payment funds institutions. Infractions of general provisions the CNBV issues alone or jointly with Banco de México that carry no specific sanction are fined 2,000 to 10,000 UMA under article 103, section XIV of that law.
When LexLint raises it
When your app profile says your app is a payment provider.