Regulations on Electronic Signatures CNBS

Object. These Standards have as their object the regulation of signatures generated under the so-called "Electronic Signature Infrastructure" (IFE), whose ownership and administration corresponds to the National Commission of Banks and Insurance (CNBS), utilized by User Institutions of the Financial Interconnection System. This norm comprises the system of accreditation and supervision of the certification authority and the registration or verification authorities, recognizing the variety of modalities of electronic signatures, the guarantees they offer, the levels of security, and the heterogeneity of the needs of their potential users.

Scope of the Standards. These standards apply to the use of electronic signatures that are generated within the IFE, in accordance with what is established in the preceding article, as well as to the agreements, covenants, services, or policies that the CNBS agrees with third parties that include electronic signatures generated by the IFE.

Regime of Certification Services and Electronic Signatures. The provision of certification services, as well as the registration or verification of electronic signatures, shall be provided by the National Commission of Banks and Insurance for use of the Supervised Institutions through the electronic channel called the Financial Interconnection Network.

Definitions. For the application of these standards and from the perspective of information technology, the following shall be understood as: 1. Certification Authority: Entity of trust, responsible for issuing and revoking digital certificates, utilized in electronic signature or non-repudiation of transactions, for which public key or asymmetric key cryptography is employed. In this particular case it corresponds to a certification services provider, which shall be the CNBS. 2. Registration Authority: Person designated by User Institutions of the IFE and authorized by the Certification Authority to identify and authenticate Subjects and with authority to act on behalf of a third party when applicable. 3. Digital Certificate: Digital document extended by the Certification Authority that guarantees the link between the identity of IFE users and their Private Key (clave). 4. Encryption: Process of converting plain text (or clear text) into illegible text, called encrypted text or ciphertext. 5. CNBS: National Commission of Banks and Insurance. 6. Compromised Key: A key has been compromised in that case in which (even when there is no certainty) it is supposed that such key is known by another person who is not the owner of the same. 7. Cryptography: Art or science of encrypting and decrypting information using techniques that make possible the exchange of messages in a secure manner that can only be read by the persons to whom they are directed. 8. Biometric Signature: Capture of handwritten signature through electronic devices, for the purpose of assuring the identity of the signatory, intended to be used in the signature of contracts, documents, receipts, protocols, and any other document that the CNBS deems appropriate. 9. Digital Signature: Cryptographic method that associates the identity of a user or computer system to the message or document using PKI technology. 10. Electronic Signature: Any symbol based on electronic means, generated within the IFE, used or adopted by someone, with the precise intention of linking, authenticating, and assuring the integrity of an electronic document or data message while meeting all or some characteristics of a handwritten signature. 11. Signatory: Corresponds to the IFE user who generates an Electronic Signature over the data. 12. IFE: Electronic Signature Infrastructure of the CNBS. 13. Public Key Infrastructure (PKI): Combination of hardware, software, organizations, practices, and processes, created for the purpose of managing policies, Certificates, and Keys. 14. Financial Interconnection: Link of individual computer networks (each of which retains its identity) to form an interconnected network. Servers of the different Institutions of the National Financial System are connected through external access Networks (WAN). Being able to access records from different machines for the exchange of information. 15. Public Key: Public part of an asymmetric key pair utilized for encryption in the sending of messages, which shall be used for the verification of digital signatures and for encrypting messages sent to the owner of the private key. 16. Private Key: Secret part of an asymmetric key pair utilized for encryption in the sending of messages; this corresponds to the key that belongs exclusively to an IFE user. 17. Declaration of Practices Manual: Legal and technological framework that leads to the Administration of the Electronic Signature Infrastructure (IFE) of the CNBS. 18. Non-Repudiation: Way of guaranteeing that the IFE user generating a message cannot subsequently deny the sending of the same. 19. ORFE: Electronic Signature Registration Officer. SECTION II ON THE USE OF ELECTRONIC SIGNATURES

Use of Electronic Signatures. The use of electronic signatures under the framework of the IFE shall provide security to the following:

• a)

  All digital communications established between the CNBS and User Institutions of the Financial Interconnection Network.

• b)

  The service of a reliable Certifying Authority, so that User Institutions of the Financial Interconnection Network may incorporate it into the platform of their electronic services.

• c)

  A solid authentication mechanism to access electronic services offered by the CNBS at both internal and external levels.

• d)

  All internal digital communications established within the CNBS.

• e)

  Preservation of all data that permits determining the origin, destination, date, and time of sending and receipt. CHAPTER III OF THE IFE SECTION I GENERAL ASPECTS

Elements. The IFE is constituted by:

• a)

  The set of electronic signatures, digital certificates, and electronic documents generated under the IFE.

• b)

  The certification practices extended by the CNBS, based on and compatible with current international standards, which assure the interoperability and functionality of the IFE.

• c)

  The software, hardware, and other appropriate components for the implementation of biometric signature and certification practices, as well as the additional security conditions comprised in the international standards implemented by the CNBS.

• d)

  The management system that allows the maintenance of the conditions indicated in the preceding subsections, as well as the security, confidentiality, transparency, and non-discrimination in the provision of its services.

• e)

  The Certification and Registration Authorities of the CNBS, as well as the Registration Authorities, represented by the Electronic Signature Registration Officer, duly accredited or recognized by the CNBS.

• f)

  The set of Resolutions, Manuals, Declarations, Procedures, contracts, Forms, or related formularies, which form an integral part of these Standards. SECTION II OF THE CERTIFICATION AUTHORITY

Functions. The Certification Authority of the IFE shall have the following functions: a) Issue digital signature certificates, maintaining the respective numbering. As well as cancel and validate certificates, when appropriate. b) May provide other services inherent to those of certification, whose characteristics and procedures shall be contained in the declaration of practices manual of the IFE.

• a)

  Comply with the Declaration of Practices of the IFE.

• b)

  Comply with the functions within the timeframes indicated in the Declaration of Practices of the IFE.

• c)

  Inform IFE users of the conditions of issuance, use, and cancellation of digital signature certificates.

• d)

  Control and maintain in strict confidence the private key used for the digital signature certificates that it issues.

• e)

  Cancel immediately the issued certificates and implement measures that the CNBS determines, when the private key of the certification authority is compromised.

• f)

  Maintain a record of the issued and canceled certificates, recording their date of issuance and validity.

• g)

  Publish permanently and continuously through the means it deems appropriate, the respective history of the issued and canceled certificates.

• h)

  Cancel the digital signature certificate in accordance with what is established in the Declaration of Practices Manual of the IFE.

• i)

  Safeguard the confidentiality of information related to applicants and holders of certificates, limiting its use to the needs proper to the certification service, except by judicial order or express request of the holder of the digital signature certificate.

• j)

  Provide necessary facilities to personnel authorized by the CNBS for purposes of supervision and audit.

• k)

  Maintain a record of canceled certificates for a minimum period of five (5) years.

• l)

  Comply with the terms under which it obtained accreditation, as well as the additional requirements established by the CNBS in accordance with what is established in these Standards. SECTION III OF THE REGISTRATION OR VERIFICATION AUTHORITIES

Functions. The Registration or Verification Authorities have the following functions:

• a)

  Fully identify the applicant for electronic signature through the collection of data and verification of the information provided by the applicant.

• b)

  Communicate to the Certification Authority the acceptance and/or authorization of the requests for issuance, modification, or cancellation of electronic signatures, as applicable.

• c)

  Manage the electronic signatures issued by the Certification Authority in accordance with these Standards.

Obligations. The registered Registration or Verification authorities have the following obligations:

• a)

  Comply with the Declaration of Practices Manual of the IFE.

• b)

  Objectively and directly establish the truthfulness of the information provided by the applicant for electronic signature.

• c)

  Maintain the confidentiality of information relating to applicants and holders of electronic signatures, limiting its use to the needs proper to the registration or verification service, except by judicial order or express request of the holder of the electronic signature or certificate.

• d)

  Collect only information or personal data of relevance established in the Declaration of Practices Manual of the IFE for the issuance of electronic signatures, and,

• e)

  The regulations that the CNBS deems appropriate.

Electronic Signature Registration Officer. Each user institution of the IFE shall designate an Electronic Signature Registration Officer (ORFE), responsible for fulfilling the functions and obligations of the Registration Authority of its Institution, established in Articles 12 and 13 of this Standard. The ORFE may be the same person currently designated to administer access to Financial Interconnection. Additionally, another person shall be trained so that in case of absence of the first, such person may substitute, it being understood that the substitute may have assigned other activities and functions if the institution deems it convenient, as long as the substitute is not performing substitution duties.

Cessation of Operations. The Registration or Verification Authority of IFE users shall cease its operations within the framework of the IFE, taking into consideration the Resolution Mechanisms established in Article 115 of the Financial System Law or the mechanisms established for such purpose in the corresponding Laws of which it forms part. SECTION IV OF THE CERTIFICATE

Requirements. The interested party in obtaining a certificate shall demonstrate what is established in the section on Initial Identity Validation that shall be described in the Declaration of Practices Manual of the IFE.

Validity. Each certificate shall have a validity period and date of expiration that shall be indicated in each certificate, in conformity with what is established for such purpose in the Declaration of Practices Manual of the IFE, with the exception of what is provided in the following Article of these Standards.

Suspension and Revocation. The suspension or revocation of a certificate must be carried out observing the grounds and procedures established in the Declaration of Practices Manual of the IFE. SECTION V OF ELECTRONIC SIGNATURE

Electronic Signatures. The Electronic Signatures (both digital and biometric) that have the validity and efficacy referred to in Article 7 of these Standards are those generated by the IFE.

Characteristics. The minimum characteristics of the electronic signature generated under the IFE are the following:

• a)

  It is exclusive to the holder of the electronic signature and to each data message signed by said holder.

• b)

  Both the signature and the signed message are encrypted, utilizing solid mechanisms of cryptography.

• c)

  It is added to or logically associated with the data message in such a manner that it is possible to detect if the electronic signature or the data message has been altered.

• d)

  Its generation is under the exclusive control of the holder of the electronic signature.

• e)

  It is capable of being verified.

Functions. Given the characteristics indicated in the preceding article, technically the electronic signature must guarantee that:

• a)

  The data message was sent and signed by the holder of the electronic signature.

• b)

  The data message has not been altered after the sender sent it.

• c)

  As a consequence of the two preceding clauses, the holder of the electronic signature cannot repudiate or disavow a data message that has been electronically signed using the IFE, given that it is maintained under their exclusive control; except if they demonstrate to a competent authority that it was used without their authorization by third parties.

Regarding the holder. Within the IFE, responsibility for the legal effects generated by the use of an electronic signature corresponds to the holder of the signature. In the case of natural persons, they are holders of the biometric signatures, the certificate, and the digital signatures generated by that natural person. In the case of juridical persons, they are the holders of the certificate and their representatives are the holders of the digital signature and the biometric signature.

Obligations of the holder. The obligations of the holder of the electronic signature are:

• a)

  To provide truthful information under their responsibility.

• b)

  To observe the conditions established for the logical and physical use of biometric signatures, digital signatures, and certificates.

• c)

  To generate the private key and digitally sign through the established procedures. Registry or Verification Authority, assuming responsibility for the truthfulness and accuracy thereof. f) In the event that the private key is compromised in its security, the holder must notify the ORFE of their Institution immediately so that said key may be revoked.

Invalidity. An electronic signature generated under the IFE loses validity if it is used: a) For purposes other than those for which it was issued. b) When the certificate has been canceled in accordance with what is established in Article 18 of Section IV of the Certificate of these rules. SECTION VI OF THE CLOSING OF OPERATIONS

Regarding the cessation of operations. The IFE shall cease its operations when the CNBS so orders and through a resolution that it issues.

Regarding the time period for cessation of operations. In accordance with the Administrative Procedure Law, the CNBS shall establish the legal time period through which the IFE shall notify both the CNBS and the holders of digital signature and biometric signature certificates of the cessation of its activities.

Regarding the publication procedure. The CNBS shall determine the publication procedure to be followed in the event of cessation of operations of the IFE, in accordance with what is established in the Manual Statement of Practices of the IFE.

Regarding the cancellation of electronic signatures upon cessation of operations. The CNBS shall cancel the certificates and biometric signatures issued by the IFE whose operations have ceased, recording the day, hour, minute, and second on which the cessation occurred. The use of the certificates and biometric signatures issued within and during its operations shall fall into disuse. CHAPTER V TRANSITORY AND FINAL PROVISIONS SINGLE SECTION

Adaptation time period. The CNBS, through a reasoned resolution, shall provide the necessary instructions so that the user institutions of the Financial Interconnection Network may program the necessary plans in order to adapt to these present rules.

Effectiveness in the use of electronic signatures. All communications that until now have been processed on common paper between the CNBS and the users referred to in Article 1 shall, as of the date of publication of these Rules in the Official Gazette La Gaceta, be conducted electronically using the IFE.

Cases not foreseen. Regarding all matters not foreseen in these Rules, the provisions of current legal dispositions shall apply.

Effective date. These present Rules shall enter into effect as of January 1, 2013. 2. To instruct the Information Technology Management that in the planning of its activities, it must incorporate training for the personnel of the Supervised Institutions, once the Electronic Signature Infrastructure administered by the National Commission of Banks and Insurance has been certified. 3. To communicate to the Supervised Institutions this Resolution for the corresponding purposes. 4. These present Rules shall be published in the Official Gazette "La Gaceta". CARLOS ROBERTO ORTEGA MEDINA Secretary's Assistant 16 M. 2012.