Regulations on Electronic Signatures Administered by the CNBS

Object. The purpose of these Regulations is to regulate signatures generated under the so-called "Electronic Signature Infrastructure" (IFE), whose ownership and administration corresponds to the National Commission of Banks and Insurance (CNBS), used by User Institutions of the Financial Interconnection System. This regulation comprises the accreditation and supervision regime of the certification authority and the registration or verification authorities, recognizing the variety of modalities of electronic signatures, the guarantees they offer, security utilities and the heterogeneity of the needs of its potential users.

Scope of the Regulations. These regulations apply to the use of electronic signatures that are generated within the IFE, in accordance with what is established in the previous article, as well as to the agreements, covenants, services or policies that the CNBS agrees with third parties that include electronic signatures generated by the IFE.

Regime of Certification Services and Electronic Signatures. The provision of certification services, as well as the registration or verification of electronic signatures, by the Commission of Banks and Insurance shall be provided for use by the Supervised Institutions through the electronic channel called the Financial Interconnection Network.

Definitions. For the application of these regulations and from the perspective of information technology, the following shall be understood as: 1. Certification Authority: Entity of trust, responsible for issuing and revoking digital certificates, used in electronic signatures or non-repudiation of transactions, for which public key or public cryptography is used. In this particular case it corresponds to a certification services provider, which shall be the CNBS. 2. Registration Authority: Person designated by the User Institutions of the IFE and authorized by the Certification Authority to identify and authenticate the Subjects and with power to act on behalf of a third party when appropriate. 3. Digital Certificate: Digital document extended by the Certification Authority that guarantees the link between the identity of the users of the IFE and their Private Key (password). 4. Encryption: Process of converting plain text (or clear text) into illegible text, called encrypted text or cryptogram. 5. CNBS: National Commission of Banks and Insurance. 6. Compromised Key: A key has been compromised in that case in which (even when there is no certainty) it is assumed that said key is known by another person who is not the owner thereof. 7. Cryptography: Art or science of encrypting and decrypting information using techniques that make possible the exchange of messages in a secure manner that can only be read by the persons to whom they are addressed. 8. Biometric Signature: Capturing of the written signature through electronic devices, for the purpose of assuring the identity of the signatory, predestined to be used in the signature of contracts, documents, receipts, protocols and any other document that the CNBS deems appropriate. 9. Digital Signature: Cryptographic method that associates the identity of a user or computer equipment to the message or document using PKI technology. 10. Electronic Signature: Any symbol based on electronic means, generated within the IFE, used or adopted by someone, with the precise intention of linking, authenticating and guaranteeing the integrity of an electronic document or data message fulfilling all or some characteristics of a handwritten one. 11. Signatory: Corresponds to the user of the IFE who generates an Electronic Signature on the data. 12. IFE: Electronic Signature Infrastructure of the CNBS. 13. Public Key Infrastructure (PKI): Combination of hardware, software, organizations, practices and processes, created for the purpose of administering policies, Certificates and Keys. 14. Financial Interconnection: Link of individual computer networks (each of which retains its identity) to form an interconnected network. The servers of the different institutions of the National Financial System shall be connected through external access networks (WAN). It being possible to access records from different machines for the exchange of information. 15. Public Key: Public part of a pair of asymmetric keys used for encryption in the sending of messages, which shall be used for the verification of digital signatures or to encrypt the messages sent to the owner of the private key. 16. Private Key: Secret part of a pair of asymmetric keys used for encryption in the sending of messages; this corresponds to the key that belongs exclusively to a user of the IFE. 17. Statement of Practices Manual: Legal and technological framework that leads to the Administration of the Electronic Signature Infrastructure (IFE) of the CNBS. 18. Non-Repudiation: Way of guaranteeing that the user of the IFE who generated a message cannot subsequently deny the sending thereof. 19. ORFE: Electronic Signature Registration Officer.

Use of Electronic Signatures. The use of electronic signatures under the IFE framework shall provide security to the following:

• a)

  All digital communications established between the CNBS and the User Institutions of the Financial Interconnection Network.

• b)

  The service of a trustworthy Certification Authority, so that the user institutions of the Financial Interconnection Network can incorporate it into the platform of their electronic services.

• c)

  A solid authentication mechanism to access the electronic services offered by the CNBS at both internal and external levels.

• d)

  All internal digital communications established within the CNBS.

• e)

  Preservation of all data that allows determining the origin, destination, date and time of sending and reception.

Elements. The IFE is comprised of:

• a)

  The set of electronic signatures, digital certificates and electronic documents generated under the IFE.

• b)

  The certification practices extended by the CNBS, based on and compatible with current international standards, which ensure the interoperability and functionality of the IFE.

• c)

  The software, hardware and other components suitable for the implementation of biometric signature and certification practices, as well as the additional security conditions comprised in the international standards implemented by the CNBS.

• d)

  The management system that allows the maintenance of the conditions indicated in the preceding paragraphs, as well as security, confidentiality, transparency and non-discrimination in the provision of its services.

• e)

  The Certification and Registration Authorities of the CNBS, as well as the Registration Authorities, represented by the Electronic Signature Registration Officer, duly accredited or recognized by the CNBS.

• f)

  The set of Resolutions, Manuals, Declarations, Procedures, contracts, Forms or related formularies, which form an integral part of these Regulations.

Functions. The Certification Authority of the IFE shall have the following functions: a) Issue digital signature certificates, maintaining the respective numbering. As well as cancel and validate the certificates, when appropriate. b) They may provide other services inherent to certification, whose characteristics and procedures shall be contained in the manual of declaration of practices of the IFE.

• a)

  Comply with the Declaration of Practices of the IFE.

• b)

  Fulfill the functions within the periods established in the Declaration of Practices of the IFE.

• c)

  Inform the users of the IFE of the conditions of issuance, use and cancellation of digital signature certificates.

• d)

  Control and keep in strict confidentiality the private key used for the digital signature certificates it issues.

• e)

  Cancel immediately the issued certificates and implement measures that the CNBS determines, when the private key of the certification authority is compromised.

• f)

  Maintain a register of the issued and cancelled certificates, recording its date of issuance and validity.

• g)

  Publish permanently and uninterruptedly by the means it deems appropriate, the respective history of the issued and cancelled certificates.

• h)

  Cancel the digital signature certificate in accordance with what is established in the Manual of Declaration of Practices of the IFE.

• i)

  Safeguard the confidentiality of information related to applicants and certificate holders, limiting its use to the needs of the certification service itself, except by court order or express request of the digital signature certificate holder.

• j)

  Provide the necessary facilities to personnel authorized by the CNBS for purposes of supervision and audit.

• k)

  Maintain a register of cancelled certificates, for a minimum period of five (5) years.

• l)

  Comply with the terms under which it obtained accreditation, as well as the additional requirements established by the CNBS in accordance with what is established in these Regulations.

Functions. The Registration or Verification Authorities have the following functions:

• a)

  Fully identify the applicant for the electronic signature through the collection of data and verification of the information provided by the applicant.

• b)

  Communicate to the Certification Authority the acceptance and/or authorization of the requests for issuance, modification or cancellation of electronic signatures, as appropriate.

• c)

  Manage the electronic signatures issued by the Certification Authority in accordance with these Regulations.

Obligations. The registered Registration or Verification authorities have the following obligations:

• a)

  Comply with the Manual of Declaration of Practices of the IFE.

• b)

  Establish in an objective and direct manner the truthfulness of the information provided by the applicant for the electronic signature.

• c)

  Maintain the confidentiality of information relating to applicants and holders of electronic signatures, limiting its use to the needs of the registration or verification service itself, except by court order or express request of the holder of the electronic signature or certificate.

• d)

  Collect only relevant personal information or data established in the Manual of Declaration of Practices of the IFE for the issuance of electronic signatures, and,

• e)

  The regulations that the CNBS deems appropriate.

Electronic Signature Registration Officer. Each user institution of the IFE shall designate an Electronic Signature Registration Officer (ORFE), responsible for fulfilling the functions and obligations of the Registration Authority of its Institution, established in Articles 12 and 13 of this Regulation. The ORFE may be the same person currently designated to manage access to Financial Interconnection. Additionally, another person shall be trained so that in the event of absence of the first person, they may substitute for him, it being understood that the substitute may have assigned other activities and functions of the Institution as long as it is not inconvenient, as long as they are not engaged in their substitution duties.

Cessation of Operations. The Registration or Verification Authority of the users of the IFE shall cease its operations within the framework of the IFE, taking into consideration the Resolution Mechanisms established in Article 115 of the Financial System Law or the mechanisms established for such purpose in the corresponding Laws of which it is part.

Requirements. The interested party in obtaining a certificate shall accredit what is established in the section on Initial Identity Validation that shall be described in the Manual of Declaration of Practices of the IFE.

Validity. Each certificate shall have a validity period and end date that shall be indicated in each certificate, in accordance with what is established for such purpose in the Manual of Declaration of Practices of the IFE, with the exception of what is provided in the following Article of these regulations.

Suspension and Revocation. The suspension or revocation of a certificate must be carried out observing the grounds and procedures established in the Manual of Declaration of Practices of the IFE.

Electronic Signatures. Electronic Signatures (both digital and biometric) that have the validity and efficacy referred to in Article 7 of these Regulations, are those generated by the IFE.

Characteristics. The minimum characteristics of the electronic signature generated under the IFE are as follows:

• a)

  It is exclusive to the holder of the electronic signature and to each data message signed by such holder.

• b)

  Both the signature and the signed message are encrypted, using solid cryptographic mechanisms.

• c)

  It is attached or logically associated to the data message in such a manner that it is possible to detect if the electronic signature or the data message has been altered.

• d)

  Its generation is under the exclusive control of the holder of the electronic signature.

• e)

  It is susceptible to being verified.

Functions. Given the characteristics indicated in the preceding article, technically the electronic signature must guarantee that:

• a)

  The data message was sent and signed by the holder of the electronic signature.

• b)

  The data message has not been altered after the sender transmitted it.

• c)

  As a consequence of the two preceding subsections, the holder of the electronic signature cannot repudiate or disavow a data message that has been electronically signed using the IFE, given that it is kept under exclusive control; except if such holder demonstrates before a competent authority that it was used without authorization by third parties.

The Holder. Within the IFE, responsibility for the legal effects generated by the use of an electronic signature corresponds to the holder of the signature. In the case of natural persons, they are holders of the biometric signatures, the certificate, and the digital signatures generated by such natural person. In the case of legal entities, they are the holders of the certificate and their representatives are the holders of the digital signature and the biometric signature.

Obligations of the Holder. The obligations of the holder of the electronic signature are:

• a)

  To deliver truthful information under their responsibility.

• b)

  To observe the conditions established for the logical and physical use of biometric signatures, digital signatures, and certificates.

• c)

  To generate the private key and to digitally sign using solid cryptographic mechanisms, assuming responsibility for the truthfulness and accuracy thereof before the Registration or Verification Authority.

• d)

  In the event that the private key becomes compromised in its security, the holder must notify the ORFE of their Institution immediately so that said key may be revoked.

Invalidity. An electronic signature generated under the IFE loses validity if it is used: a) For purposes different from those for which it was issued. b) When the certificate has been canceled in accordance with the provisions of Article 18 of Section IV regarding the Certificate of these Norms. SECTION VI CLOSURE OF OPERATIONS

Cessation of Operations. The IFE shall cease its operations when the CNBS so provides and by resolution that it issues.

Term for Cessation of Operations. In accordance with the Administrative Procedure Law, the CNBS shall establish the legal term by which the IFE shall notify both the CNBS and the holders of digital signature certificates and biometric signatures of the cessation of its activities.

Publication Procedure. The CNBS shall determine the publication procedure to be followed upon cessation of operations of the IFE, in accordance with the provisions established in the IFE Statement of Practices Manual.

Cancellation of Electronic Signatures upon Cessation of Operations. The CNBS shall cancel the certificates and biometric signatures issued by the IFE whose operations have ceased, recording the day, hour, minute, and second in which the cessation thereof occurred. The use of the certificates and biometric signatures issued within and during its operations shall be rendered obsolete. CHAPTER V TRANSITORY AND FINAL PROVISIONS SOLE SECTION

Term for Compliance. The CNBS, by means of a reasoned resolution, shall provide the necessary instructions so that the user institutions of the Financial Interconnection Network program the necessary plans in order to comply with the present Norms.

Effectiveness in the Use of Electronic Signatures. All communications that until now have been conducted on common paper between the CNBS and the users referred to in Article 1, as of the date of publication of the present Norms in the Official Gazette La Gaceta, shall be conducted electronically using the IFE.

Unforeseen Cases. In all matters not provided for in these Norms, the provisions contained in the applicable legal dispositions shall apply.

Effective Date. The present Norms shall enter into force as of January 1, 2013. 2. To instruct the Information Technology Management that in the planning of its activities, it must incorporate training to the personnel of the Supervised Institutions, once the Electronic Signature Infrastructure administered by the National Banking and Insurance Commission has been Certified. 3. To communicate to the Supervised Institutions the present Resolution for the corresponding purposes. 4. The present Norms must be published in the Official Gazette "La Gaceta". CARLOS ROBERTO ORTEGA MEDINA Assistant to the Secretariat 16 M. 2012.