MexicoLey para Regular las Instituciones de Tecnología Financiera, open finance interfaces
LRITF, art. 76 (open finance interfaces)
In force.
A data subject rights rule binding private bodies.
- Obligation class
- Data subject rights, Consent, Disclosure, Access restriction
- Audit expectation
- none
What it requires
- If you are a financial entity, money transmitter, credit information company, clearing house, financial technology institution or company authorized to operate with novel models, establish standardized application programming interfaces that let your interfaces connect with other such entities and with specialized information technology third parties, to share open financial data, aggregated data and transactional data (art. 76).
- Share transactional data, which are the clients' personal data, only with the client's prior express authorization, and use the information shared only for the purposes the client strictly authorized (art. 76).
- Interrupt access to client information as soon as the client withdraws consent, vulnerabilities put the information at risk, or the third party breaches the agreed terms, and notify the supervisory commission or Banco de México of the interruption within two hours of detecting it (art. 76).
- If you are a third party seeking access through the interfaces, obtain the prior authorization of the supervisory commission or, for credit information companies and clearing houses, Banco de México (art. 76).
- Register with the supervisory commission or Banco de México the consideration you charge for the data exchange, at least thirty calendar days before a new or increased charge takes effect (art. 76).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
In English: the listed financial entities must open standardized interfaces for data sharing and must cut off access within a stated time and notify the authority of the interruption within two hours. Article 76 names the notice to the authority of an interruption of access, which is a report of an event and not a log, and carries no territorial clause, so the row carries no jurisdiction hook.
- Kind
- None
- As of
What this law does
Article 76 obliges financial entities, money transmitters, credit information companies, the clearing houses of the Ley para la Transparencia y Ordenamiento de los Servicios Financieros, financial technology institutions and companies authorized to operate with novel models to establish standardized application programming interfaces that let their interfaces connect with each other and with specialized information technology third parties, to share open financial data, aggregated data and transactional data.
Transactional data are the clients' personal data and may be shared only with the clients' prior express authorization, and the information may be used only for the purposes the client strictly authorizes. The entities must interrupt access as soon as the client withdraws consent, vulnerabilities put client information at risk, or the third party breaches the agreed terms, and must notify the supervisory commissions or Banco de México of the interruption within two hours of detecting it.
The exchange is subject to provisions of general application that the supervisory commission, or Banco de México for credit information companies and clearing houses, issues, and access through the interfaces requires the prior authorization of those authorities. The entities must register with the commissions or Banco de México the consideration they charge for the exchange, at least thirty calendar days before a new or increased charge takes effect.
When LexLint raises it
When your app profile says your app is a bank, is a lender, is a payment provider or processes personal data.
Back to the example · Lint your app
Page updated .