Mexico central bank tightens rules on electronic transfers

Mexico's central bank on Friday tightened requirements for participants in the country's electronic interbank payment system (SPEI), following a wave of coordinated attacks that manipulated the system earlier in the year was made public.

Those attacks, coordinated between hackers and client accomplices, cost banks an estimated 300mn pesos (US$16mn). Still under investigation, the incidents put pressure on authorities to quickly act to close vulnerabilities.

Among the provisions, the central bank said additional measures needed to be taken to protect the system with transfers to firms that operate with cryptocurrencies, creating a host of rules that look to shape the way crypto-related companies do business in Mexico.

"The [central] bank has decided to establish additional obligations for SPEI participants to reinforce security policies and controls in the transfer of funds, improve response schemes against potential risks and have full identification of operations, particularly when dealing with transfers to companies that may allow the exit of resources from the financial sector to virtual assets," said the central bank.

Under the new requirements, detailed in memorandums to the financial sector, participants will have to follow specific protocols in the event of an attack on the SPEI infrastructure.

They must also document what measures and actions participants have taken in an effort to meet the requirements, including those taken with regard to activities with third parties that could effect operations between the participant and SPEI.

Personnel policies

The monetary authority also placed additional evidentiary burden on banks in determining the trustworthiness of employees handling SPEI transactions, requiring participants to establish and implement tests of trust and integrity both with internal personnel and any third parties they are working with in relation to SPEI.

The edict also orders participants to designate an information security officer responsible for the design, implementation and verification of cybersecurity risk prevention policies. The officer would also be charged with implementation of corrective measures before the materialization of these risks that could affect the operation of SPEI.

Crypto caution

The memoranda also detail requirements meant to strengthen security in the transfer of funds to customers or companies that offer the exchange or purchase of virtual assets, commonly referred to as cryptocurrencies.

The bank offered the following breakdown of the crypto rules:

• Participants must identify those accounts belonging to this type of client in order to be able to implement additional validations prior to the accreditation of funds from funds transfers through the SPEI - essentially flagging all such accounts as crypto-related.
• Those participants in SPEI that carry accounts on behalf of the indicated clients must pay the corresponding resources to the money transfer orders they receive on the following business day of their receipt. This rule stands until the firm has been given authorization by the central bank, as administrator of SPEI, to carry out the transactions in different terms.
• In the event of the central bank issuing a notification of possible attacks on SPEI, participants must refrain from making funds available to crypto-related entities on the same day transfers are requested.
• The accounts that SPEI participants make available to this type of company must be sight deposit or "open call" deposit accounts, and only if they are authorized to open this kind of account.
• They must refrain from providing accounts to these companies with the purpose that these are, in turn, assigned to clients for the transfer of funds destined to the purchase of virtual assets.