## 1mexea2023002

## Source details

**Canonical URL:** [1mexea2023002](https://www.imf.org/-/media/files/publications/cr/2023/english/1mexea2023002.pdf)

## Other formats

- [Markdown version](/-/media/files/publications/cr/2023/english/1mexea2023002.pdf.md)
- [Structured JSON version](/-/media/files/publications/cr/2023/english/1mexea2023002.pdf.json)

---

### Introduction and methodology
- Assessment of implementation of the Basel Core Principles for effective banking supervision (BCPs) by the National Banking and Securities Commission (CNBV) as part of the FSAP by the IMF and the World Bank.
- Missions: between March 22 and April 4 and between June 21 and July 4, 2022; assessment reflects the regulatory and supervisory framework in place at time of completion.
- Methodology: BCBS BCP methodology issued September 2012; Mexico chose to be assessed and graded against Essential Criteria (EC) only.
- Team: Jorge Cayazzo (IMF external expert) and Juan Ortiz (World Bank).
- Sources reviewed: laws, rules, guidance, CNBV materials, Banxico, banking sector participants; authorities provided self‑assessment, questionnaires, supervisory documents and confidential files.
- Key methodological considerations:
  - 2012 BCP revision raised supervisory expectations and added principles (including corporate governance).
  - Proportionate approach: expectations commensurate with complexity, interconnectedness, size, risk profile and cross‑border operations.
  - Assessments require judgment and are not directly comparable across jurisdictions or to prior assessments (prior BCP assessment in Mexico was in 2012 under 2006 methodology; FSAP update in 2016 did not include BCP assessment).

### Institutional and market structure; market size (as of December 2021 unless noted)
- Key regulators: SHCP, Banxico, CNBV, IPAB, CNSF, CONSAR, CONDUSEF.
- CNBV mandate: supervise and regulate entities within remit (LIC and other laws); ensure stability and proper functioning and promote sound and balanced development to protect public interest.
- Market composition and assets (total regulated system assets: MXN20,403 billion — 100.0 percent):
  - Private banks (50): MXN11,078 billion — 54.3 percent share; equivalent to 42.2 percent of GDP.
    - CNBV groups private banks into six supervisory categories: G-7; eight medium-sized commercial; 14 small commercial; seven specialized in credit to households; four specialized in foreign exchange; and 10 investment banks.
    - Share of total assets of the 21 Mexican foreign‑owned banks amounted to 67 percent.
  - Investment funds (616): MXN2,816 billion — 13.8 percent.
  - Development Banks and Development Funds (6 + 7): MXN2,555 billion — 12.5 percent.
    - Two DBs accept deposits representing 1.9 percent of total deposits from the public.
  - Social Service Organizations (3): MXN2,149 billion — 10.5 percent.
  - Brokerage Houses (36): MXN862 billion — 4.2 percent.
  - Popular Savings and Credit Entities (273): MXN309 billion — 1.5 percent.
  - Regulated Multiple Purpose Financial Companies (43): MXN604 billion — 3.0 percent.
  - Auxiliary Credit Organizations and Activities (OAAC) (23): MXN29 billion — 0.2 percent.
- Fintech: as of December 2021, CNBV authorized 24 Fintech companies: 14 electronic payment fund institutions and 10 collective funding institutions.
- Commercial bank assets: as of March 2021, commercial banks’ assets totaled MXN10.95 trillion, 9.2 percent smaller in real terms than March 2020.

### Banking sector soundness, liquidity, profitability, and COVID response
- Capitalization and profitability:
  - Capital ratios stood at 19.5 percent as of December 2021.
  - Accumulated profit as of December 2021 totaled MXN182 million, 65.7 percent higher in real terms compared to the same period of 2020.
  - ROE reached 14.6 percent in December 2021 (9.0 percent in December 2020).
- Liquidity:
  - Sector median LCR was 233.4 percent in March 2022.
- Credit portfolio and asset quality:
  - Private banks’ credit portfolio: MXN 5,549 billion (as of December 2021).
  - Delinquency rate (IMOR) peaked January 2021 at 2.7 percent and ended December 2021 at 2.1 percent.
  - Adjusted delinquency rate (IMORA), which includes write-offs, moved from 5.3 percent to 4.5 percent over the same period.
  - Credit to private sector recovering slowly; households lead recovery (consumer credit and housing); credit to firms continues to drop.
- CNBV COVID‑19 regulatory response:
  - Temporary accounting flexibilities April–July 2020 for payment facilities to clients performing as of February 28, 2020.
  - Second phase allowed one-time restructuring/refinancing of credits outstanding on April 31, 2020 under “Covid additional accounting facilities”; new operations formalized no later than January 31, 2021.
  - Rules on deferral and prorating of new allowances in 12 months; surplus provisions cannot be recognized as profits.
  - Reporting/disclosure requirements for new operations including impact on provisions and capital.
  - Dividend guidance:
    - March 31, 2020: CNBV recommended banks not pay dividends, carry out share buy-backs or remunerate shareholders; exceptions required written CNBV notice.
    - April 19, 2021: recommendation allowing distribution of up to 25 percent of combined net profits of 2019 and 2020, subject to conditions including maintaining at least a 13 percent capital ratio and D‑SIB distributions consistent with TLAC strategy.

### Macroeconomic and macroprudential setting; Banxico liquidity role
- Fiscal/debt framework:
  - Article 73 CPEUM restricts debt use to finance productive infrastructure.
  - Article 17 of the Federal Budget and Treasury Responsibility Law establishes the principle of balanced budget (zero public deficit).
- Macroprudential toolkit:
  - Capital and liquidity tools and D-SIB buffers introduced; core funding ratio in FX and measures to reduce vulnerabilities in investment funds are in place.
  - Recommendation to expand toolkit and enhance time‑varying use; publish CCyB guideline; consider LTV and DSTI limits in medium term given no evidence of credit/housing booms.
- Banxico liquidity facilities:
  - Intraday repo operations; collateralized overnight overdraft facility (backstop up to DRM amount); Ordinary Additional Liquidity Facility (FLAO) intra-day with higher cost and special request requirement.
  - Banxico discloses transaction‑based TIIE for overnight, month, three months, six months; methodology complies with IOSCO principles.

### Financial stability governance and resolution framework
- CESF (Financial System Stability Council):
  - Composition: nine voting members (finance minister (Chair) and deputy minister; Banxico governor and two deputy governors; heads of CNBV, CNSF, CONSAR; chief executive of IPAB).
  - Issues recommendations with de facto comply-or-explain mechanism; meets at least quarterly; supported by Technical Committee and Sustainable Finance Committee since March 2020.
- Crisis management and resolution:
  - Recovery and resolution plans in place for all commercial banks.
  - D-SIBs required to increase loss absorbency complementing Basel III.
  - Preparations for bridge bank use and cooperation agreements with major home jurisdictions.
  - IPAB deposit insurance fund projected to reach 3.4 percent of insured deposits in 2027 and 5.1 percent in 2032.
- Recommended enhancements:
  - Introduce bail-in powers with creditor protections; revise creditor hierarchy.
  - Trigger resolution on authorities’ assessment of nonviability rather than quantitative thresholds.
  - Make (partial) purchase and assumption with a bridge bank primary resolution strategy for systemic banks; bring FHCs under resolution regime; grant resolution authority powers to remove impediments to resolvability and shorten planning cycles.

### Main findings on supervisory framework and assessment grades (selected)
- Prior BCP work:
  - Last full BCP assessment in 2012 under 2006 methodology; FSAP 2016 recommended strengthening CNBV independence and budgetary autonomy and consolidated supervision.
- Core Principles materially non-compliant at time of assessment:
  - Principle 2 — Independence, accountability, resourcing, and legal protection: Materially Non-compliant.
  - Principle 12 — Consolidated supervision: Materially Non-compliant.
  - Principle 19 — Concentration risk and large exposure limits: Materially Non-compliant.
- Examples of other assessments:
  - Principle 1 — Responsibilities, objectives, and powers: Largely Compliant.
  - Principle 3 — Cooperation and collaboration: Compliant.
  - Principle 4 — Permissible activities: Compliant.
  - Principle 5 — Licensing criteria: Compliant.
  - Principle 6 — Transfer of significant ownership: Compliant.
  - Principle 7 — Major acquisitions: Compliant.
  - Principle 8 — Supervisory approach: Largely Compliant.
  - Principle 9 — On-site/off-site mix and supervisory tools: Largely Compliant.
  - Principle 11 — Corrective and sanctioning powers: Largely Compliant.
  - Principle 14 — Corporate governance: Largely Compliant.
  - Principle 15 — Risk management process: Largely Compliant.
  - Principle 16 — Capital adequacy: Largely Compliant.
  - Principle 17 — Credit risk: Compliant.
  - Principle 18 — Problem assets, provisions and reserves: Compliant.
  - Principle 20 — Transactions with related parties: Largely Compliant.
  - Principle 21 — Country and transfer risks: Largely Compliant.
  - Principle 22 — Market risk: Compliant.
  - Principle 23 — IRRBB: Compliant.
  - Principle 24 — Liquidity risk: Largely Compliant.
  - Principle 25 — Operational risk: Largely Compliant.
  - Principle 26 — Internal control and audit: Compliant.
  - Principle 27 — Financial reporting and external audit: Compliant.
  - Principle 28 — Disclosure and transparency: Compliant.
  - Principle 29 — Abuse of financial services (AML/CFT): Largely Compliant.

### Capital, leverage, risk‑weighted assets, and related supervisory points
- Total risk weighted assets (June 2022): MXN7.75 Trillion.
- RWA composition (June 2022): 70 percent credit risk; 20 percent market risk; 10 percent operational risk.
- Banks applying IRB models: CNBV approved the use of 28 IRB credit risk models to six banks for limited portfolios.
- Capital requirements and buffers:
  - Minimum regulatory components and buffers listed: 4.5 percent CET1; 6.0 percent AT1; 8.0 percent T2; 2.5 percent Capital Conservation Buffer; 0–2.5 percent Countercyclical Buffer; 0.6 percent–2.25 percent Systemic buffer for Mexican D-SIBs.
  - With conservation buffer and countercyclical buffer at 0 percent, all Mexican banks subject to a 10.5 percent capital requirement.
- Aggregate figures (system): banking system median CAR: 18.65 percent. Five biggest banks (67 percent of system assets) operate with CARs that range from 13.68 percent to 24.44 percent; CET1 ranges from 11.23 percent to 16.35 percent.
- Leverage: banks to monthly publish leverage ratio; Article 172 Bis 39 CUB establishes a 3% soft minimum leverage requirement.

### Credit risk, problem assets, provisioning, and supervision
- Private banks’ credit portfolio: MXN 5,549 billion (December 2021).
- Credit classification and provisioning:
  - Classification stages 1, 2, 3 mapped to a nine-class master scale A-1 to E (Article 129).
  - Provisions: EL = PD * LGD * EAD; stage 1 EL 12‑month horizon, stages 2/3 lifetime; 100 percent PD for stage 3.
  - LGD estimates for retail portfolios range from 60 to 75 percent; repossessed assets provisioning full coverage in 30 months for moveable assets and 5 years for real estate (Article 132).
- Supervisory oversight:
  - CNBV conducts on-site and off-site reviews; receives monthly regulatory reports including credit parameters and can require reclassification and additional provisions.
  - Annex 33 Accounting Standard B-6 and Annex 15: internal rating models restricted to consumer loans and corporate loans up to UDI 2 million (equivalent to MXN270,000).
- Assessment outcomes:
  - Principle 17 — Compliant.
  - Principle 18 — Compliant.

### Concentration, large exposures, and related parties
- Large exposures framework issues:
  - Article 54 CUB maximum permissible financing limits vary by capital ratio; no formal definition of large exposure at generally accepted 10 percent level; no maximum aggregated lending limit for all large exposures.
  - Article 58 requires tracking/reporting exposures ≥ 10 percent of basic capital.
  - Limits not applicable on a fully consolidated basis up to highest regulated parent in Mexico (financial holding company regulated by SHCP).
  - Ongoing revision of regulation on large exposures to align with Basel standard (implementation delayed due to COVID‑19).
- Related parties:
  - Article 73 LIC defines related parties; Article 73 Bis LIC sets an aggregated limit for standard related parties equal to 35 percent of Tier 1 maximum lending limit as a whole set of parties related to an institution.
  - Exposures exceeding 25 percent of adjusted Tier 1 capital must be deducted from Tier 1 capital in specific cases.
- Assessment outcomes:
  - Principle 19 — Materially Non-compliant.
  - Principle 20 — Largely Compliant.

### Supervisory approach, tools, and CEFER
- CEFER (enhanced supervisory rating methodology introduced November 2015):
  - Entities score on a scale 1- to 4+; components: Inherent risks, Mitigants, Net risk, Financial strength, Additional criteria; expert judgment can change rating by +/- 2 notches with justification.
  - Uses: categorize entities, allocate monitoring resources, establish priorities for Annual Supervisory Plan (PAS), define supervisory strategy, determine inspection frequency.
- Recommendations:
  - Enhance CEFER by reducing number of indicators used to determine inherent risks and rely more on expert judgment for mitigants to improve risk‑based supervision and application of Pillar 2 measures.
  - CNBV has not yet imposed Pillar 2 requirements.

### Supervisory on-site/off-site practices and information systems
- Information collection:
  - CNBV receives the 66 regulatory reports listed in Annex 36 of the CUB via SITI; Article 213 CUB mandates electronic submission and quality validations.
- On-site/off-site mix:
  - Off-site and on-site functions split between vice-presidencies; planning and execution follow MIS and Mapas de Proceso del Sistema Integral de Organización.
  - Off-site surveillance uses prudential returns and CEFER; on-site inspection results reported for follow-up via Oficio de observaciones and Oficio de medidas correctivas.
- Use of prudential returns and stress testing:
  - ICAAP: banks evaluate capital adequacy under one base and one adverse scenario; banks submit capital projection for 10 quarters in each scenario.
  - CNBV conducts annual supervisory stress tests and system-wide Capital Adequacy Assessment.
- Assessment:
  - Principle 9 — Largely Compliant.

### Operational risk, IT, cyber and business continuity
- Operational risk framework:
  - Defined and regulated in CUB; specialized DGSROT created.
  - Requirements: loss event database, operational risk indicators, Disaster Recovery Plan (DRP), Business Continuity Plan (BCP).
- IT and cybersecurity:
  - Articles 168 bis 11–13 CUB require information security policies and appointment of CISO.
  - Cyber on-site inspections began April 2022 but resource constrained.
- Assessment:
  - Principle 25 — Largely Compliant; cyber supervision needs enhanced staffing/resources.

### Internal controls, audit, external audit, disclosure
- Internal control and audit:
  - Articles 141–142 CUB require internal control systems and independent internal audit; Audit Committee oversight; CNBV assesses during on-site reviews.
  - Principle 26 — Compliant.
- External audit and financial reporting:
  - External auditors adhere to ISAs; rotation required at least every five years (CUAE Article 7).
  - CNBV has powers to require new audits, remove/suspend auditors; auditors must report irregularities to CNBV (CUAE Article 40).
  - Principle 27 — Compliant.
- Disclosure:
  - CUB Articles 176–186 set disclosure requirements; banks must publish qualitative and quantitative disclosures quarterly/annually.
  - Principle 28 — Compliant.

### AML/CFT supervision and CDD/KYC (Principle 29)
- Legal framework and CNBV role:
  - SHCP responsible for AML/CFT regime implementation; CNBV is competent agency for banks under LFPIORPI and related regulations.
  - CNBV VPSPP includes 72 AML/CFT specialists.
- CDD/KYC requirements:
  - DCG 115 provisions: risk‑sensitive CDD including PEPs, UBO identification, recordkeeping for 10 years, client classification (Provision 25a and 25a Bis).
  - Clients to be reassessed every six months or more frequently as warranted.
- Suspicious reporting:
  - Unusual operations reported within three business days; well‑founded suspicions may be reported within 24 hours.
- Supervisory practices:
  - AML/CFT Inspection Guidelines published March 2018 (amended 2021); CNBV uses SupTech dashboards and thematic reviews.
- Assessment:
  - Principle 29 — Largely Compliant. Recommendation to continue advancing towards full risk‑based supervision.

### Key statistics and factual points (verbatim)
- Missions: March 22–April 4 and June 21–July 4, 2022.
- Total regulated system assets: MXN20,403 billion — 100.0 percent.
- Private banks assets: MXN11,078 billion — 54.3 percent; equivalent to 42.2 percent of GDP.
- Private banks’ credit portfolio (December 2021): MXN 5,549 billion.
- Capital ratios: 19.5 percent (December 2021).
- Sector median LCR: 233.4 percent (March 2022).
- Accumulated profit (December 2021): MXN182 million, 65.7 percent higher in real terms compared to same period of 2020.
- ROE: 14.6 percent (December 2021); 9.0 percent (December 2020).
- Total RWA (June 2022): MXN7.75 Trillion.
- Market risk RWA (December 2021): MXN1.57 trillion — 20 percent of total RWAs.
- Five biggest banks hold 67 percent of system assets; their CARs range from 13.68 percent to 24.44 percent; CET1 from 11.23 percent to 16.35 percent.
- Deposit insurance fund projections: 3.4 percent of insured deposits in 2027; 5.1 percent in 2032.
- CNBV Board: 13 members; 5 appointed by SHCP; 3 by Banxico; 1 by CONSAR; 1 by CNSF.
- At time of assessment, 7 domestic financial conglomerates had not requested authorization by SHCP.
- LAF enacted in 2014.
- Article 73 LIC: current aggregated maximum limit with standard ‘related parties’ is 35 percent of capital.
- Annex 15 CUB restricts internal rating models to consumer loans and corporate loans up to UDI 2 million (equivalent to MXN270,000).

### Selected recommended actions (organized)
- Governance and independence:
  - Grant CNBV effective operational independence, strengthened governance and budget autonomy; consider decentralization.
  - Reform CNBV Board appointment/removal rules: term appointments, disclosure of removal reasons, statutory protections.
  - Strengthen legal protection for supervisors and staff against frivolous litigation.
- Consolidated supervision:
  - Make application of consolidated supervision legal framework mandatory for financial groups operating in Mexico.
  - Introduce legal amendments to grant authorities power to impose prudential regulations at group level.
  - Amend legal framework to permit authorities to discretionally determine the perimeter of consolidated supervision.
- Risk‑based supervision and CEFER:
  - Reduce number of inherent‑risk indicators; rely more on expert judgement for mitigants; set internal quality assurance and peer review for on‑site examination quality.
  - Sharpen CEFER prior to applying Pillar 2 capital measures.
- Large exposures and related parties:
  - Implement 2016 BCBS standards on large exposures; provide formal definition of large exposures; align limits with Basel.
  - Amend Article 73 LIC to reduce the 35 percent aggregated related‑party limit to levels consistent with international practice.
  - Reinforce CNBV powers to determine related parties and apply consolidated limits at holding company level.
- Capital and liquidity:
  - CNBV to consider using Pillar 2 powers as appropriate after enhancing supervisory toolkit.
  - Require deposit‑taking development banks to adhere to prudential liquidity regulation comparable to commercial banks.
- Crisis management and resolution:
  - Introduce bail-in powers; revise creditor hierarchy; trigger resolution on nonviability; extend regime to FHCs; make purchase and assumption with bridge bank primary for systemic banks.
- Operational and cyber risks:
  - Increase staffing/resources for cyber supervision and IT risk; expand cyber on‑site inspections.
- AML/CFT:
  - Continue advancing towards a full-fledged AML/CFT risk‑based supervision and expand thematic/ad-hoc reporting where needed.

*Italic: Source: INTRODUCTION AND METHODOLOGY and selected chapters/excerpts from IMF FSAP assessment of Mexico (1mexea2023002).*

### INTRODUCTION AND METHODOLOGY ________________________________________________________ 5

### INTRODUCTION AND METHODOLOGY

### Assessment scope and methodology
- Assessment of implementation of the Basel Core Principles for effective banking supervision (BCPs) by the National Banking and Securities Commission (CNBV) as part of the Financial Sector Assessment Program (FSAP) by the IMF and the World Bank.
- Assessment performed during two missions: between March 22 and April 4 and between June 21 and July 4, 2022, reflecting the regulatory and supervisory framework in place at the time of completion.
- Assessment against the BCP methodology issued by the Basel Committee on Banking Supervision (BCBS) in September 2012.
- Mexico chose to be assessed and graded against Essential Criteria (EC) only.
- The 2012 revision of the BCPs contains 247 separate essential and additional criteria; this report describes and grades only ECs.
- The assessment team comprised Jorge Cayazzo (IMF external expert) and Juan Ortiz (World Bank).
- The team reviewed laws, rules, guidance, held extensive meetings with CNBV, and met with Banxico and banking sector participants. Authorities provided a self‑assessment, responses to questionnaires, supervisory documents and files on a confidential basis.

### Key methodological considerations
- The 2012 BCP revision raised supervisory expectations, added new principles (including corporate governance) and strengthened requirements on supervisors and the approaches to supervision.
- The assessment adopts a proportionate approach: supervisory expectations and standards should be commensurate with the complexity, interconnectedness, size, risk profile and cross‑border operations of banks.
- Assessments require judgment and are not directly comparable across jurisdictions or to prior assessments (the prior BCP assessment in Mexico was in 2012 against the 2006 methodology; there was an FSAP update in 2016 that did not include a BCP assessment).

### Institutional and market structure — overview
- Key regulatory and supervisory institutions: SHCP, Banxico, CNBV, IPAB, CNSF, CONSAR, CONDUSEF.
- Mandates:
  - SHCP: planning, coordinating, evaluating, monitoring the banking system.
  - Banxico: promote sound development of the financial system, foster proper functioning of payment systems, protect public interest, ensure stability of the currency's purchasing power; acts as reserve bank and lender of last resort for credit institutions.
  - IPAB: guarantees savers' deposits and is the bank resolution authority.
  - CONSAR and CNSF: supervise retirement funds managers and insurance/sureties institutions respectively.
  - CONDUSEF: consumer protection authority for users of financial services.
- CNBV mandate: supervise and regulate entities within remit (LIC and other relevant laws); main goal to ensure stability and proper functioning and promote sound and balanced development of the financial system to protect the interest of the public.

### Market size, composition, and structure (As of December 2021 unless otherwise noted)
- Private banks (50): MXN11,078 billion — 54.3 percent share of regulated system assets; equivalent to 42.2 percent of GDP.
  - CNBV groups private banks into six supervisory categories: G-7 (the seven largest banks, of which 6 are domestic systematically important banks, or D-SIBs); eight medium-sized commercial; 14 small commercial; seven specialized in credit to households; four specialized in foreign exchange; and 10 investment banks.
  - The share of total assets of the 21 Mexican foreign‑owned banks amounted to 67 percent.
- Investment funds (616): MXN2,816 billion — 13.8 percent.
- Development Banks and Development Funds (6 + 7): MXN2,555 billion — 12.5 percent.
  - Six development banking institutions and 6 Trusts. Two DBs accept deposits representing 1.9 percent of total deposits from the public.
- Social Service Organizations (3): MXN2,149 billion — 10.5 percent.
- Brokerage Houses (36): MXN862 billion — 4.2 percent.
- Popular Savings and Credit Entities (273): MXN309 billion — 1.5 percent.
- Regulated Multiple Purpose Financial Companies (43): MXN604 billion — 3.0 percent.
- Auxiliary Credit Organizations and Activities (OAAC) (23): MXN29 billion — 0.2 percent.
- Total regulated system assets: MXN20,403 billion — 100.0 percent.
- As of December 2021, CNBV authorized 24 Fintech companies: 14 electronic payment fund institutions and 10 collective funding institutions.
- As of March 2021, assets of commercial banks totaled MXN10.95 trillion, 9.2 percent smaller in real terms than March 2020.

### Banking sector soundness, liquidity, and profitability
- Capitalization:
  - Capital ratios stood at 19.5 percent as of December 2021.
  - Capital ratios improved due to strong profitability, pandemic‑linked suspension of dividend payouts, regulatory adjustment reducing capital requirements for some credit segments, decline in lending activity reducing risk‑weighted assets growth, and strengthening of net capital by internal means.
- Liquidity:
  - Sector median LCR was 233.4 percent in March 2022.
- Profitability:
  - Accumulated profit as of December 2021 totaled MXN182 million, 65.7 percent higher in real terms compared to the same period of 2020.
  - ROE reached 14.6 percent in December 2021 (9.0 percent in December 2020).
- The report notes the banking system’s robust capitalization and liquidity allowed it to absorb pandemic‑related shocks and support economic stability, while highlighting exposure to macroeconomic trends: acceleration of inflation, increases in interest rates and expectations, continued weakness of investment, and reactivation of economic activities closer to pre‑pandemic levels.

### CNBV regulatory response to COVID‑19
- CNBV issued regulatory measures ('oficios') during April, September, and October 2020.
- Temporary accounting flexibilities:
  - From April 2020 to July 2020, CNBV allowed accounting flexibilities for credit institutions to provide payment facilities to clients with consumer, mortgage and commercial loans that were fully performing as of February 28, 2020.
  - Second phase: banks could restructure or refinance—only once—credits (excluding related parties) outstanding on April 31, 2020, applying “Covid additional accounting facilities.” Banks had to reassess ability to pay and expected credit loss; new operations formalized no later than January 31, 2021.
  - Regulations detailed risk classification and provisioning rules allowing deferral and prorating new allowances in 12 months; concessions could be prorated; surplus provisions could not be recognized as profits but as a reserve for future allowance or to offset concessions.
  - New operations had to be reported to CNBV and disclosed in financial statements, including their impact on provisions and capital.
- Dividend and profit distribution guidance:
  - On March 31, 2020, CNBV recommended banking institutions not to pay dividends, carry out share buy-backs or remunerate shareholders; exceptions required written notice to CNBV.
  - On April 19, 2021, CNBV issued a recommendation allowing distribution of up to 25 percent of the combined net profits of 2019 and 2020, subject to conditions including maintaining at least a 13 percent capital ratio and D‑SIB distributions consistent with TLAC strategy.

*Source: INTRODUCTION AND METHODOLOGY, IMF FSAP assessment of Mexico (missions March 22–April 4 and June 21–July 4, 2022).*

### 16. Private banks’ credit portfolio amounted, as of December 2021, to MXN 5,549 billion.

### 16. Private banks’ credit portfolio amounted, as of December 2021, to MXN 5,549 billion

### Credit conditions and asset quality
- Private banks’ credit portfolio: MXN 5,549 billion (as of December 2021).
- Credit to the private sector is recovering slowly and has not yet reached pre-pandemic levels; the recovery is not homogeneous.
  - Strongest demand: households (mainly consumer credit and housing).
  - Credit to firms: continues to drop.
- Delinquency metrics:
  - Delinquency rate (IMOR) peaked in January 2021 at 2.7 percent and ended December 2021 at 2.1 percent.
  - Adjusted delinquency rate (IMORA), which includes write-offs, went from 5.3 percent to 4.5 percent over the same period.

### Preconditions for effective banking supervision — macroeconomic and macroprudential setting
- Fiscal and debt framework:
  - Article 73 of the Political Constitution (CPEUM) restricts debt use to finance productive infrastructure.
  - Article 17 of the Federal Budget and Treasury Responsibility Law establishes the principle of balanced budget (zero public deficit) and sets circumstances and criteria for addressing extraordinary deficits; legislature must approve the budget and maximum debt ceilings.
- Macroprudential toolkit and suggestions:
  - Capital and liquidity tools and D-SIB buffers introduced in line with Basel requirements.
  - Core funding ratio in FX and measures to reduce vulnerabilities from related-party exposures and liquidity risks in investment funds (e.g., swing pricing, redemption fees) are in place.
  - Authorities could consider expanding the toolkit and enhancing time-varying use.
  - Plans to finalize and publish a guideline for the countercyclical capital buffer (CCyB) are welcome; action at the current early stage of the financial cycle would be helpful.
  - With no evidence of credit and housing booms, introducing limits on loan-to-value and debt-service-to-income ratios could be considered as a medium-term agenda.

### Banxico’s role and liquidity facilities
- Mandate and objectives:
  - Banxico’s mandate includes conserving the purchasing power of the national currency and promoting sound development of the financial system and payment systems (Articles 28 of the CPEUM; Articles 1 and 2 of the Bank of Mexico Law).
- Instruments and facilities:
  - Uses short- and long-term instruments to achieve appropriate overnight interbank interest rate and manage liquidity.
  - Layers of liquidity-providing facilities:
    - Intraday repo operations to ease potential liquidity pressures in the payment system.
    - Collateralized overnight overdraft facility (against banks’ deposits in the central bank or repo) as an end-of-day backstop up to a limit equal to the amount of Monetary Regulation Deposits (DRM).
    - Ordinary Additional Liquidity Facility (FLAO) provided during the day for temporary short-term liquidity needs; FLAO has a higher funding cost than the reference rate and requires a special request to Banxico.
  - Banxico calculates and discloses the Interbank Equilibrium Interest Rate (TIIE) for overnight, month, three months, and six months; the methodology is transaction-based and complies with IOSCO principles on financial benchmarks.

### Financial stability governance and macroprudential framework
- Financial System Stability Council (CESF):
  - Explicit, formal mandate to promote stability of the financial system.
  - Composition: nine voting members (finance minister (Chair) and deputy minister; Banxico governor and two deputy governors; heads of three supervisors (CNBV, CNSF, CONSAR); chief executive of IPAB).
  - CESF lacks regulatory hard powers; it issues recommendations with a de facto comply-or-explain mechanism and coordinates measures within authorities’ respective responsibilities.
  - Presidency: SHCP; Secretariat: Banxico.
  - Supported by a Technical Committee and, since March 2020, the Sustainable Finance Committee to analyze climate-related risks.
  - Mandated to meet at least once every quarter; publishes press releases after meetings and an annual report on stability.

### Legal, accounting, audit, and payment system infrastructure
- Legal framework:
  - Constitution instructs the State to ensure stability of public finances and the financial system and to help generate favorable conditions for growth and jobs.
  - Implementing laws: (i) establish powers of financial authorities for policy, supervision, regulation and consumer protection; (ii) govern operations of intermediaries and participants; (iii) commercial and mercantile laws maintain coherent interpretation vis-à-vis other laws.
- Accounting and audit:
  - Mexico has implemented an accounting framework based on IAS and IFRS standards.
  - IFRS Standards adopted for all listed companies other than financial institutions and insurance companies since January 2012; financial institutions and insurance companies use Mexican reporting standards.
  - Mexican Council for Financial Information Standards (CINIF) issues accounting regulations aligned with international standards.
  - CNBV is the accounting standard setter for Mexican financial institutions; issues rules generally aligned to IFRS and sometimes directly applies CINIF standards by supplementation.
  - External audits are widespread; CNBV regulates the audit profession through the Consolidated External Audit Regulation (CUAE) and certification of compliance officers and external auditors in AML/CFT matters.
- Payment systems:
  - Operated and regulated by Banxico: SIAC, SPEI, and CoDi among others.
  - Banxico adopted Basic Principles for Systemically Important Payment Systems (January 2001) and publishes the list of systems meeting those characteristics yearly.
  - Oversight of SPEI could be strengthened by establishing a more formalized oversight function, improving transparency, and addressing gaps identified in the CPMI-IOSCO PFMI implementation monitoring exercise.
- Consumer protection:
  - Law for the protection and defense of the user of financial services policed by CONDUSEF.
- Justice system reforms:
  - Mexico is reforming civil and commercial justice to increase oral procedures for commercial disputes; most cases still handled by the unreformed justice system, which faces shortcomings.

### Crisis management, recovery, and resolution
- Progress and remaining gaps:
  - Recovery and resolution plans in place for all commercial banks.
  - D-SIBs required to increase loss absorbency complementing Basel III reforms.
  - Preparations for using bridge bank tool progressed; cooperation agreements signed with major home jurisdictions; emergency lending facilities clarified including to banks in resolution.
  - IPAB improved deposit payout and communication capabilities, with innovations like cardless ATM payouts.
- Recommended enhancements:
  - Introduce bail-in powers while appropriately protecting creditors; revise creditor hierarchy to make banks’ loss-absorbing requirements more effective.
  - Trigger resolution when authorities deem a bank ‘nonviable’ rather than waiting for quantitative thresholds.
  - Remove barriers to effective use of purchase and assumption transactions and bridge banks; a (partial) purchase and assumption transaction with a bridge bank—likely preceded by bail-in—should become the primary resolution strategy for systemic banks instead of open bank assistance.
  - Bring financial holding companies (FHCs) under the resolution regime to address contagion risk and avoid diverging liquidation procedures across group members.
  - Resolution authority should gain powers to remove impediments to resolvability (e.g., changes in business practices, structure, or organization) and to shorten the resolution planning cycle for systemic and mid-size banks; banking supervisor should support this process while statutory powers are awaited.
- Deposit insurance fund:
  - Authorities project the deposit insurance fund will reach 3.4 percent of insured deposits in 2027 and 5.1 percent in 2032.

### Main findings and supervisory framework
- BCP assessments:
  - FSAP reviewed information on all 29 BCPs; last full BCP assessment was in 2012 under the 2006 methodology, with two principles materially non-compliant or non-compliant (independence and legal protection, operational risk).
  - 2016 FSAP recommended strengthening CNBV’s independence and budgetary autonomy, providing effective legal protection for supervisors, and enhancing CNBV’s ability to perform consolidated supervision.
- Supervisory approach:
  - Room for improvement in risk-based supervision.
  - CNBV’s risk-based rating methodology (CEFER) updated in November 2015; with sensible refinements, CEFER could be a sharper instrument for risk-based supervision.
- Large exposures regulation:
  - Amended regulations on large exposures are expected to be issued by 2022; revision includes new definitions and revised limits for “common risk” and “related parties” to better align with Basel III standards.
- Consolidated supervision gaps:
  - CNBV has increased powers with the Financial Groups Law (LRAF) of 2014 but falls short of effective implementation.
  - Financial Holding Companies operate in Mexico but fall outside the current consolidated supervisory umbrella, creating AML/CFT and prudential gaps.
  - Possible measures to strengthen consolidated supervision:
    - Make application of the consolidated supervision legal framework mandatory for financial groups operating in Mexico.
    - Introduce legal amendments to grant authorities power to impose prudential regulations at group level.
    - Amend the legal framework so the perimeter of consolidated supervision can be discretionally determined by the authorities.

### Detailed assessment methodology
- Assessment grading scale for Principles:
  - Compliant: all applicable essential criteria met without significant deficiencies.
  - Largely compliant: only minor shortcomings; overall effectiveness sufficiently good.
  - Materially non-compliant: severe shortcomings despite formal rules; supervision not effective.
  - Non-compliant: no substantive implementation; several essential criteria not complied with or supervision manifestly ineffective.
  - “Not applicable” grading can be used under certain circumstances.

*Source: 1mexea2023002 - 16. Private banks’ credit portfolio amounted, as of December 2021, to MXN 5,549 billion.*

### 36. In addition, a Principle will be considered not applicable when, in the view of the

### 36. In addition, a Principle will be considered not applicable when, in the view of the

### A. Supervisory powers, responsibilities, and institutional framework (overview)
- Three main governmental agencies regulate the Mexican banking system: the National Banking and Securities Commission (CNBV), the Bank of Mexico (Banxico), and the Ministry of Finance and Public Credit (SHCP).
- CNBV is the primary supervisory authority over banking activity and is an independent agency of SHCP.
- Banxico is an autonomous central bank with its role set out in the Ley del Banco de México.
- SHCP issues rules to develop the provisions of the Credit Institutions Law (LIC) and authorizes formation of financial groups for consolidated supervision purposes.
- Additional agencies: IPAB (bank resolution authority) and CONDUSEF (protects financial services customers).
- Prudential regulations are compiled in the Single Banking Circular (CUB).

### Principle 1 — Responsibilities, objectives, and powers (assessment: Largely Compliant)
- Key legal bases and mandates:
  - Responsibilities and objectives of CNBV set in Art. 117 of the LIC and CNBV Law (Ley de la Comisión Nacional Bancaria y de Valores).
  - LIC is the main body of banking law; CUB compiles CNBV general rules applicable to banks.
- Findings on prudential powers and consolidated supervision:
  - CNBV issues and periodically amends prudential regulations via the CUB and may impose additional requirements on specific banks (Article 2 bis 117 of the CUB).
  - Article 74 of the LIC allows CNBV to require additional capital for individual banks.
  - Supervisory powers to impose prudential measures apply only on an individual-bank basis and do not encompass banking groups operating in Mexico.
  - Law on Financial Groups (LRAF) allows SHCP to authorize financial holding companies to be subject to consolidated supervision, but:
    - (a) Several domestic financial conglomerates remain outside current consolidated supervision (7 domestic conglomerates had not requested authorization at time of assessment; banks in non‑supervised groups account for around 4 percent of total bank deposits).
    - (b) Authorized financial groups are required to report consolidated financials but are not subject to prudential requirements on a consolidated basis; authorities lack power to apply prudential regulation at group level.
  - Current arrangement does not empower an effective lead supervisor with autonomous group‑level supervisory powers.
- Assessors’ recommendations to enhance compliance:
  - Make application of consolidated supervision legal framework mandatory for financial groups operating in Mexico.
  - Introduce legal amendments to grant authorities power to impose prudential regulations at group level.
  - Amend legal framework to permit authorities to discretionally determine perimeter of consolidated supervision.

### Principle 2 — Independence, accountability, resourcing, and legal protection (assessment: Materially Non-compliant)
- Governance and appointment:
  - CNBV’s governance, powers, and accountability derived from CNBV Law; CNBV is a deconcentrated body of SHCP.
  - CNBV’s Board has 13 members; SHCP has direct authority to nominate or remove 10 at its discretion, including the President of the Commission.
  - President and vice-presidents of CNBV are not appointed for a specific term; the Minister of Finance and Public Credit can remove them without specific reasons (CNBV’s Law Article 14).
  - Senior staff can be removed at the sole discretion of the President of CNBV with no obligation to disclose reasons.
- Accountability and transparency:
  - CNBV’s objectives are defined in law (Article 2); CNBV publishes an annual report; Strategic Plan exists but is not publicly available.
  - Governing Board composition: SHCP appoints five members; Bank of Mexico three members; CONSAR and CNSF one member each; members must occupy at least the position of general director of the Federal Public Administration or equivalent.
  - Governing Board meets at least once every two months; quorum at least seven members; resolutions by majority; President has casting vote.
  - CNBV has an Ethics and Conflicts of Interest Prevention Committee and a Code of Conduct.
- Resources and budgetary constraints:
  - CNBV’s budget is approved by SHCP and subject to federal fiscal austerity measures; CNBV has no autonomy to establish/modify its own budget.
  - Supervision fees are collected from regulated entities but CNBV receives just a fraction from the Government; fees pay for supervision (LCNBV, Article 18).
  - Limitations identified:
    - (a) Dependence on the PEF makes it difficult to create new required positions.
    - (b) Salary scale structure requires Federal Government authorization, hindering attraction/retention of experienced staff relative to supervised entities.
    - (c) Hiring external experts requires SHCP approval and depends on annual budget.
  - Impact of austerity and compensation laws: 2019 Federal Law of Republican Austerity and 2021 Law of Public Servant Compensation reduced salary levels and affected activities (reduction in training, limited resources for on-site domestic supervision); average job tenure of supervisors dropped from 12.4 years in 2018 to 8.4 years in 2021.
- Legal protection:
  - Article 271 of the LIC mandates CNBV to provide legal assistance and defense to actual and former managers and staff for acts carried out in exercise of function.
  - A dedicated fund (‘fideicomiso’) established with a minimum amount of 30 million pesos to support supervisors being sued; assessors indicate this does not ensure protection over time.
- Assessment comments and recommended reforms:
  - CNBV governance structure results in direct and significant influence of SHCP on CNBV affairs; no term appointments, no statutory reasons for dismissal, no disclosure requirements for removals.
  - CNBV should be granted effective operational independence, strengthened governance, and budget autonomy, becoming a decentralized body.
  - Current legal protection provisions do not fully mitigate risks of frivolous actions against individual staff.

### Principle 3 — Cooperation and collaboration (assessment: Compliant)
- Domestic cooperation:
  - Article 97 of LIC provides for exchange of information among SHCP, Banxico, CNBV, CONSAR, IPAB, and CONDUSEF.
  - Suite of MOUs in place; examples include MOUs in 2000, 2007, 2008, 2012, 2013, 2014, 2017, 2018, 2020 covering information exchange, joint examinations, cybersecurity, and consolidated supervision.
  - Evidence that arrangements function in practice.
- Cross-border cooperation:
  - CNBV empowered to exchange information with foreign counterparts based on bilateral MOUs; participates in supervisory colleges.
  - More than 80 MOUs signed to strengthen cross-border consolidated supervision for banks; assessors reviewed joint inspection reports and extensive correspondence.
- Confidentiality protections:
  - Article 143 of LIC allows CNBV to provide foreign authorities with information and requires reciprocity when banking secrecy applies.
  - MOUs contain confidentiality provisions; receiving supervisors must treat information as confidential and use only for supervisory purposes.
  - Article 143 also allows refusing to provide information when intended use differs from request or contravenes public order, national security, or MOU terms.
- Resolution and recovery planning:
  - Banks must have recovery plans approved by CNBV after obtaining opinions of SHCP, IPAB and Banxico (Article 119 of the LIC and CUB provisions).
  - CNBV can request simulations/drills and update recovery plans; CNBV empowered to revoke licenses (Article 28 of LIC) after hearing affected entity and obtaining Banxico and IPAB opinion.
  - Banking Stability Committee (CEB) (SHCP, Banxico, IPAB, CNBV) evaluates systemic risk and gives direction on resolution options.
  - IPAB, with participation of CNBV, SHCP and Banxico, prepares resolution plans for all commercial banks (Article 120 of the LIC).

### Principle 4 — Permissible activities (assessment: Compliant)
- Definitions and restrictions:
  - Art. 2 of the LIC: banking and credit services (ability to raise funds from the public) can only be provided by credit institutions or other authorized financial entities.
  - Credit institutions defined as multiple-purpose banking institutions or development banks; permissible activities defined in Art. 46 of the LIC (28 activities including deposit-taking, issuing bonds, issuing credit cards, granting loans, custodial services).
  - Article 105 of the LIC reserves use of the word “bank” to authorized credit institutions.
  - Art. 2 and Art. 103 of LIC restrict taking of deposits to authorized credit institutions, properly authorized financial intermediaries, savings and loan cooperatives, and associations/companies that collect funds from own members.
- Public list of licensed banks:
  - Art. 8 of LIC: bank licenses are published in the Diario Oficial de la Federación.
  - CNBV maintains a current list of licensed banks and branches of foreign banks (Padrón de Entidades Supervisadas) available on CNBV website.

### Principle 5 — Licensing criteria (assessment: Compliant)
- Licensing authority and process:
  - CNBV empowered to approve (Art. 8 LIC) and revoke (Art. 28 LIC) licenses; granting license requires CNBV Board approval and a binding opinion from Banxico.
  - LIC establishes criteria and documentation required (Arts. 8–10; CUB annexes) including articles of incorporation, list of planned activities, aspiring managers’ personal information, source of paid‑in capital, shareholders’ list, strategic/operating plan, internal controls, IT systems, and financial viability study.
  - Applicant has 30 days to start operations after approval or CNBV may revoke license; on-site visit conducted to verify conditions.
  - No licensing manual publicly available, but internal procedures and documentation lists exist.
- Fit-and‑proper and shareholder assessment:
  - Fit-and-proper requirements in LIC (Arts. 10, 22–24); CNBV can remove board members/managers and suspend persons under LIC Art. 25.
  - Annex 53 and 54 of CUB require disclosure of assets, liabilities, origin of resources for shareholders planning to hold 2 percent or more, and certifications of good standing.
- Initial capital:
  - Article 19 of LIC establishes a minimum initial capital amount: minimum capital requirement of approximately US$33 million (90 million unidades de inversión—UDIs).
- Monitoring of new entrants:
  - Once operational, banks are subject to CNBV continuous monitoring (on-site and off-site) to verify compliance with strategic goals and supervisory requirements.
- Assessors’ comment:
  - Licensing procedure would benefit from an internal guideline detailing explicit criteria to assess financial soundness of significant shareholders.

### Principle 6 — Transfer of significant ownership (assessment: Compliant)
- Definitions and thresholds:
  - Article 22 Bis of LIC defines control and decision‑making power; Article 17 LIC defines equity stake approval thresholds at 5 percent and 20 percent (and control/majority).
- Notification and approval requirements:
  - Purchases of >2 percent of paid‑in capital must be notified to CNBV within three working days (Art. 14 LIC).
  - Acquisitions >5 percent require formal CNBV approval and consideration of Banxico’s opinion (Art. 17); 20 percent or more requires CNBV clearance and Banxico’s binding opinion.
  - Applicants for significant ownership must meet criteria used for approving new banks and provide detailed information (LIC Articles 22 Bis‑II).
- Supervisory powers and enforcement:
  - CNBV may deny approvals under Art. 17; Art. 18 suspends corporate rights for transfers in contravention of law until authorization is obtained.
  - Violations of Art. 17 subject to administrative sanctions (e.g., fine up to 15,000 days of salaries) under Art. 108 LIC.
- Reporting and beneficial ownership:
  - Banks must prepare and send twice a year to CNBV a report on the integration of capital including names and data of significant shareholders and percentage participation.
  - Mexican regulation uses the term “beneficial owners” though not formally defined; Annexes require disclosure of UBOs where participations are held via legal persons, trusts or vehicles.

### Principle 7 — Major acquisitions (assessment: Compliant)
- Legal limits and approval thresholds:
  - Article 75 of LIC: limits on investments in nonfinancial firms; investments between 5 percent and 15 percent of paid‑in capital cannot be held longer than three years without CNBV approval; investments >15 percent or to be kept longer than three years require CNBV approval (Banxico provides nonbinding opinion).
  - Sum of a bank’s investments in nonfinancial institutions shall not exceed 5 percent of the bank’s deposit base.
  - Article 88: investments in and acquisitions of companies providing ancillary services require CNBV approval.
  - Article 89: investments in financial companies registered abroad require CNBV approval regardless of amount.
- Assessment criteria and required information:
  - LIC provides objective criteria (amount, nature, holding period) and allows CNBV to approve larger stakes for development or long maturity projects.
  - For authorization, applicants must provide certified bylaws, list of shareholders, information on management, operational/business plan including contingency plan, economic/operational viability for minimum three years, and draft contracts.
- Cross-border investments and supervision considerations:
  - Article 89 requires Mexican bank to ensure foreign institution adheres to applicable foreign regulations and Mexican authorities’ rules when Mexican bank owns ≥51 percent or controls foreign entity.
  - CNBV may consider effectiveness of supervision in host country and its ability to exercise consolidated supervision; in practice CNBV pays attention to these issues during examination.
- Risk mitigation:
  - LIC Art. 75 requires diversification and compliance with rules on concentration of credit, market, liquidity, and operational risk; acquisitions/investments are subject to prudential measures by CNBV.

### Principle 8 — Supervisory approach (findings up to EC3 presented)
- Risk-based supervisory methodology:
  - In November 2015 CNBV introduced the enhanced supervisory rating methodology (CEFER — Calificación de Entidades Financieras con Enfoque de Riesgos).
  - CEFER structure and scoring:
    - Entities score on scale 1- to 4+ (1- best, 4+ riskiest); qualification process is quarterly.
    - Components: Inherent risks (quantitative indicators; scored 1 to 4), Mitigants (qualitative indicators: corporate governance, management, risk management and control, auditing), Net risk (inherent risks adjusted by mitigants), Financial strength (indicators of capacity to absorb losses/liquidity shortages), Additional criteria (i) shares traded on formal exchange, (ii) presence of holding company, (iii) institution's relevance within financial system).
    - Expert judgment can change rating by +/- 2 notches with justification.
  - Uses of CEFER results:
    - (a) Categorize entities by level of risk and compare similar entities.
    - (b) Allocate monitoring resources.
    - (c) Establish priorities for Annual Supervisory Plan (PAS).
    - (d) Define supervisory strategy for each institution.
    - (e) Determine frequency of on-site inspections.
- Forward‑looking assessment and supervisory processes:
  - CNBV uses CEFER and an early warning system to identify emerging risks and to inform supervisory strategy.
  - Supervisor verifies that each bank’s internal risk profile covers risks inherent to its business model and that deviations are reported to Board and addressed.
  - Regulatory stress testing exercises are carried out yearly under adverse scenarios to assess institutions' financial strength.
- Compliance monitoring:
  - Ongoing monitoring includes continuous surveillance and on‑site examinations.
  - Monthly follow‑up on regulatory compliance for limits including Capital Adequacy Ratio (CAR/ ICAP, Art. 50 LIC), credits to related parties (Art. 73 Bis LIC), investments in real estate (Art. 55 section I LIC), and investments in adaptations/improvements to real estate (Art. 55).

_Italic: Source: 1mexea2023002 — excerpt from IMF assessment chapter provided in the supplied content._

### section II of the LIC.

### Section II of the LIC

### Incorporation of macroeconomic environment into supervision (EC4)
- CNBV uses the Capital Assessment Exercise (ICAAP) to incorporate the macroeconomic environment into supervisory strategies.
- Banks carry out at least once a year an evaluation of capital adequacy under supervisory scenarios (determined by the authorities) and internal scenarios (determined by banks).
- Financial projections use two macroeconomic scenarios: one base and one adverse, considering changes in: Gross Domestic Product (GDP), unemployment, inflation, trade balance, stock market performance, exchange rate and national and foreign interest rates.
- Based on the Capital Adequacy Assessment outcome, CNBV may request corrective measures to strengthen a bank’s capital position.
- Banxico and the CESF include stress test results in their reports; these are analyzed jointly by supervisory authorities and the central bank to assess risks to individual institutions and the financial system.

### Supervisory monitoring of system-wide risks and concentrations (EC5)
- CNBV exchanges information and analysis with members of the Financial System Stability Council (CESF) to monitor macroeconomic and market developments’ impact on the financial and banking systems.
- Communication with other government agencies is facilitated by multiparty and ad-hoc memoranda on cooperation.
- CNBV cooperates with other financial supervisory agencies (IPAB, CNSF, Banxico and CONSAR) to understand developments in nonbank financial institutions and to share risk assessments.
- Institutions must have capital and liquidity recovery plans (RP); CNBV approves RPs after a binding opinion from IPAB, Banxico and SHCP.
- The Technical Vice Presidency of CNBV carries out monthly analyses of risks faced by supervised entities, including:
  - Credit risk.
  - Concentration risk (by counterparty and economic sector).
  - Liquidity risk.
  - Interconnectivity and interbank funding market risk.
- Supervisory areas periodically inform the president and governing board of CNBV on matters for consideration and approval; CNBV Board composition (SHCP, the Bank of Mexico, the CNSF and CONSAR) facilitates communication.

### Assessing resolvability and structural impediments (EC6)
- Resolvability concerns are not yet part of CNBV’s supervisory approach.
- There are no procedures in place to assess banks’ resolvability.

### Framework for handling banks in stress, corrective and resolution actions (EC7)
- CNBV has a prompt corrective actions regime that facilitates timely corrective measures ranging from informal instructions to intervention and liquidation (suspension of license); MOUs with other relevant authorities are activated to coordinate resolution.
- Capital-deficit escalation and required measures:
  - If capital ratio falls below 4.5 percent: automatic resolution.
  - If capital falls between 10.5 percent and 8 percent: CNBV will require a capital conservation plan and the application of corrective measures.
  - If capital falls below 8 percent, but not below 4.5 percent: CNBV will require a capitalization plan and will dictate specific corrective measures such as restrictions on payment of dividends, suspension of share repurchases, amortization or conversion of subordinated debt into capital, and cancellation of bonus payments.
- Legislation describes grounds for revocation and prevention mechanisms, indicating powers, communications and responsibilities of CNBV, SHCP, Banxico and IPAB, as well as deadlines to trigger actions.

### Supervisory perimeter and bank-like activities (EC8)
- CNBV is obliged to investigate and report acts involving unauthorized entities carrying out bank-alike activities requiring prior authorization.
- If banks restructure activities to avoid the regulatory perimeter, CNBV has a broad range of options to order corrective measures, irrespective of sanctions.

### Assessment of Principle 8
- Overall assessment: Largely Compliant.
- Comments:
  - The CEFER was a significant step toward risk-based supervision.
  - Assessors concluded the CEFER methodology is based on best practices and allows CNBV to classify banks by risk profile and identify supervisory focus areas.
  - Recommendation: enhance the tool to better assess actual risk levels in banks by reducing the number of indicators used to determine inherent risks to a sufficient set and by relying more on expert judgement for mitigants rather than formal checks, thereby facilitating a more risk-based approach and application of Pillar 2 measures.

### Supervisory techniques and tools — Principle 9: on-site and off-site mix, planning, and information use (EC1–EC3)
- EC1 — Mix of on-site and off-site supervision:
  - CNBV employs a mix of on-site and off-site supervision.
  - Off-site and on-site duties are split between two vice-presidencies (VPs); each VP has approximately the same number of departments (Direcciones Generales de Supervisión) and similar examiner headcount.
  - Supervisors demonstrate a good understanding of bank risks in their portfolios.
  - The Institutional Monitoring Portal (PIN) and "Mapas de Procesos" of the "Sistema Integral de Organización" describe planning and execution processes for on-site and off-site activities.
  - Criteria for on-site inspection strategy include:
    - CEFER findings and results
    - Supervisory priorities
    - Findings from previous examinations
    - Relevant external events
    - New regulations
  - Inspection results are reported to the off-site function for follow-up, evaluation adjustments, and possible sanctions or corrective actions.
  - CNBV has internal controls to determine adequacy of monitoring plans and quality/effectiveness of on-site reviews and off-site surveillance reports.
  - Recent on-site examinations have been affected by sanitary and social distancing measures related to the COVID-19 pandemic and national vaccination progress.

- EC2 — Planning and execution processes:
  - CNBV has coherent processes and manuals (MIS and Mapas de Proceso del Sistema Integral de Organización) to ensure thorough and consistent oversight with clear responsibilities, objectives and outputs.
  - Inspection strategy and off-site/on-site rules are clearly established; supervisory strategies are determined at the start of an examination cycle using prior findings, supervisory ratings (CEFER matrix, updated quarterly), risk assessments, and other concerns.
  - Inspection planning is determined by each Deputy General Director for the bank under review, with meetings to explain examination objectives to involved staff.
  - Off-site reviews analyze prudential returns, auditors’ reports and published financial statements, and may identify areas requiring specialized on-site review.
  - Off-site supervision is used to perform risk assessments via the Risk Matrix (CEFER), which lists inherent risk categories (e.g., credit, market, liquidity, operational, legal), identifies the risk level (5 levels), risk trend (increasing, stable, or decreasing), and mitigating factors (internal controls, corporate governance).
  - Coordination and information sharing between on-site and off-site functions include meetings at each step, constant communication during visits, jointly prepared memos containing observations and major findings (Oficio de observaciones), and collaboration on corrective action memos (Oficio de medidas correctivas).
  - A Supervision Committee (Grupo de Supervision) exists to discuss horizontal and systemic issues.

- EC3 — Use and validation of information:
  - CNBV’s primary information source is regulatory reports received directly from banks; these are thoroughly vetted and validated, including on-site visits when needed.
  - A CNBV department checks consistency and accuracy of information reported by banks.
  - CNBV reviews monthly financial reports, reports on related party transactions, reports on internal and external audit, capitalization index calculations, and other bank-generated risk management materials.
  - Off-site supervision is conducted quarterly through financial analysis focused on each bank’s main risks derived from its core business activities.
- CNBV receives on a regular basis the 66 regulatory reports listed in Annex 36 of the CUB (Reportes Regulatorios) for surveillance and supervision.

*Source: section II of the LIC (1mexea2023002).*

### conclusion, prudential returns are actively used in the supervision process and to develop

### 1mexea2023002 - conclusion, prudential returns are actively used in the supervision process and to develop

### Use of prudential returns and legal framework
- Article 213 of the CUB establishes that institutions must send regulatory information to CNBV, electronically, through the Interinstitutional Information Transfer System (SITI).
- The information must comply with the validations established in the SITI, as well as the quality standards indicated by CNBV.
- Once the information is received, it is reviewed to verify compliance with quality control standards. In case the information is considered incorrect or incomplete, corresponding sanctions are imposed.
- Regulations establish CNBV power to request any additional information, other than the periodic information that supervised entities must provide, required for supervisory purposes.
- The periodic reports submitted through the SITI include: Financial Situation, Commercial Credit Report, Guarantee Report, Credit Risk Rating, Operational Risk Report, Consolidated Financial Information, Regulatory Capital Report, Qualitative Information, Risks, Claims, among others (Article 207 of the CUB).

### Supervisory tools and regular assessment (EC4)
- The supervisor uses a variety of tools to regularly review and assess the safety and soundness of banks and the banking system:
  - (a) analysis of financial statements and accounts.
  - (b) business model analysis.
  - (c) horizontal peer reviews.
  - (d) review of the outcome of stress tests undertaken by the bank.
  - (e) analysis of corporate governance, including risk management and internal control systems.
- CNBV monitoring tools include:
  - Review of financial statements complying with Financial Reporting Standards (NIF) and CUB chapter "Disclosure of financial information".
  - CEFER results identifying exposition of risks and quality of control and risk management practices.
  - Internal risk reports analyzing main trending risks (credit, market, liquidity among others).
  - Business model analyses based on financials, corporate governance minutes, press releases, and continuous communications with bank management.
  - Capital adequacy report (internal assessment under Basel standards, ICAAP).
  - Peer groups analysis based on CEFER, financial statements and regulatory reports.
- If potential risk or material situation is identified, the banking institution is informed and corrective actions are required.

### System-wide risk identification and stress testing (EC5)
- CNBV seeks to identify, assess and mitigate emerging risks across banks and the banking system, including conducting supervisory stress tests (individual and system-wide).
- CNBV carries out the annual Capital Adequacy Assessment of the banking sector to assess resilience to adverse economic scenarios.
- Chapter VI Bis (Internal Assessment of Capital Adequacy) of the CUB requires institutions to carry out an internal assessment of capital (ICAAP), including analysis of capacity to cover possible losses in different macroeconomic scenarios and capital projection based on scenarios considered.
- Institutions must have a capitalization plan when the ICAAP indicates capital shortages, identifying origin and terms of resources required.
- Institutions must estimate movements in all components of financial statements under both internal scenarios and supervisory scenarios determined by CNBV, which will be at least:
  - (a) Base Scenario: performance under expected macroeconomic assumptions considering the projections of Banxico and SHCP.
  - (b) Adverse Scenario: performance under unfavorable macroeconomic projections.
- Stress testing exercises enable early identification of emerging risks for inclusion in the macroprudential agenda (Banxico, CESF) and in CNBV supervisory strategies.
- CNBV maintains a "watch list" to monitor troubled banks and prevent adverse scenarios in advance.
- Results of CNBV risk analyses are regularly presented at the CESF.

### Evaluation and reliance on internal audit (EC6)
- On-site examinations assess internal audit function independence and effectiveness within risk management.
- The LIC contains detailed provisions on internal audit functions (Section V “De la Auditoría Interna”).
- CNBV supervisors evaluate internal audit during onsite examinations focusing on independence, staffing adequacy, staff expertise, frequency and scope, and audit plan adequacy.
- CNBV receives internal audit plans and quarterly progress reports.
- Supervisors verify that:
  - The IA fulfills the minimum functions identified in the regulation.
  - The IA is independent with respect to business and administrative areas.
  - The IA informs findings to Audit Committee and the Board of Directors.
  - The IA have adequate planning and execution processes.
  - The IA covers main risks.
- Banks must send CNBV:
  - The annual internal audit plan, which must incorporate findings observed by CNBV as a result of supervisory examinations.
  - The reports elaborated by the AI in the execution of its responsibilities.
- Internal audit reports are assessed as part of supervisory routines and CNBV relies on those deemed high-quality.

### Communication, escalation, and follow-up (EC7, EC8, EC9)
- CNBV maintains channels of communication with all levels of bank management; frequency of visits depends on risk profile and systemic importance of the entity.
- Offsite supervisors engage with internal auditors, Risk Committee members, and compliance officers to follow up on emerging problems or trends.
- CNBV communicates findings via written reports and discussions; significant findings are conveyed to the Board of Directors through an official letter and senior management receives an official letter with on-site examination findings.
- Supervisory meetings with Board members and senior management are attended by the supervision vice-president, director general, and deputy director general; the president of CNBV may attend if necessary.
- Supervisory reports are mostly rule-based and effective for verifying compliance with prudential regulations but lack depth on risk management practices and corporate governance issues (see comments to CP8 and recommendations to improve CEFER methodology).
- Supervisors may demand specific measures or an action plan at the end of on-site inspections or during inspection/off-site monitoring; CNBV follows up on actions and measures, paying special attention to effectiveness of bank responses.

### Notifications, third parties, and limitations (EC10, EC11)
- Neither the LIC nor the CUB explicitly specify that changes in activities or structure that do not require explicit CNBV approval must be notified to the Commission; CNBV does not have explicit powers to oppose such changes if not explicitly regulated.
- In practice, CNBV gains knowledge of such events through day-to-day contact with institutions.
- Article 16 of CNBV Supervisory Regulation (RSCNBV) allows supervisors to hire auditors and other professionals to assist in supervisory duties.
- CNBV reports not to make use of external consultants to perform supervisory work; supervisors may make use of independent third parties provided there is a clear and detailed mandate and the supervisor does not outsource prudential responsibilities.

### Supervisory information systems and reporting standards (EC12; Principle 10 EC1–EC3)
- CNBV maintains several supervisory information systems that facilitate processing, monitoring and analysis of prudential information; outputs inform follow-up supervisory actions.
- Supervisors can monitor and analyze prudential information through alerts and stress testing results calculated and distributed by the technical vice-presidency; alerts automatically identify rule breaches or potential risks from submitted data.
- CNBV is empowered under the last paragraph of Article 5 of CNBV Law to request all kinds of information and documents from supervised entities.
- Periodic financial returns through SITI capture on- and off-balance sheet liabilities and assets, profit and loss, capital adequacy, liquidity, large exposures, loan loss provisioning, foreign currency and exchange rate related contracts, loan classification, staffing, maturity of items and deposits by currency denomination—permitting CNBV to get a fair picture of risk profiles and risk exposures of individual banks and the system as a whole.
- In Mexico, banks submit prudential reports based on Accounting Standards defined by CNBV; requirements align with internationally accepted accounting principles (Annex 33 of the CUB).
- Article 102 of the LIC mandates CNBV to establish rules to ensure adequate valuation of assets and liabilities for accounting purposes; banking regulation includes valuation rules and other accounting and financial statement matters.

### Assessment and high-level findings
- Assessment of Principle 9: Largely Compliant.
- Supervisory reports reviewed (on-site examination reports, supervisory plans, banks’ financial assessment reports, letters of observation and corrective measures) were mostly rule-based—effective for compliance verification but less effective at conveying meaningful findings on risk management and corporate governance.
- Deployment of supervisory resources required adjustments due to budgetary restrictions (see CP 2); CNBV has coped without seriously affecting core supervisory activities.

*Source: 1mexea2023002 - conclusion, prudential returns are actively used in the supervision process and to develop*

### Chapter II of title Three of the CUB, Articles 175 Bis to 175 Bis 8).

### 1mexea2023002 - Chapter II of title Three of the CUB, Articles 175 Bis to 175 Bis 8)

### Supervisory responsibilities, valuation and price providers
- Board of Directors approves contracting of a price provider; designation must be notified to CNBV.
- Risk Committee approves internal valuation models and modifications, including:
  - methods of estimating variables not provided by price providers;
  - securities and financial instruments to which internal models apply.
- CNBV has a specialized department supervising pricing providers and maintains regular communication with other CNBV surveillance areas; adjustments to valuations are requested if areas determine valuations are inadequate.

### Data collection, comparability, access and validation (EC4–EC12)
- Frequency and coverage of returns:
  - CNBV requires returns on a monthly, quarterly, semi-annual, or annual basis.
  - Most schedules submitted monthly (assets and liabilities, loan classification, provisioning).
  - Liquidity reports submitted on a daily basis.
  - All banking institutions submit the same set of information regardless of size.
- Comparability:
  - CNBV’s technological platform allows off-site examiners to make meaningful comparisons between banks and banking groups; supports management of information across institutions and sectors and facilitates aggregated statistical data.
- Information powers and scope:
  - CNBV law (Art. 19) empowers CNBV to request and receive any relevant information from banks, broader than other agencies.
  - CNBV can obtain quantitative and qualitative information, including internal management reports and information on controlling shareholders (with some exceptions).
  - Article 120 of the LIC: IPAB, with CNBV, Banxico and SHCP, may prepare confidential resolution plans and request necessary information from banks, including group companies.
- Records and staff access:
  - CNBV empowered to review all necessary bank records; banks obliged to provide data, reports and information required by CNBV.
- Enforcement of timely and accurate reporting:
  - Late submission or inaccurate information can lead to monetary penalties and other enforcement actions.
  - Article 108 of the LIC establishes economic sanctions for non-compliance with reporting obligations under Articles 181–183 of the CUB.
- Validation processes:
  - Specialized CNBV areas quantitatively validate content, process and store data; off-site supervisors analyze indicators (liquidity, solvency, leverage, related-party transactions, ROE).
  - Quarterly reports compare trends with the previous 12-month period.
  - Annual returns verified for compliance with accounting standards in the CUB and CINIF; on-site inspections corroborate regulatory returns.
- Use of external experts:
  - No verification to date by external experts, but CNBV can hire external consultants or external auditing firms to conduct supervisory tasks.
  - External auditors obliged to report acts carried out to the detriment of the bank regardless of impact on financial situation.
- Periodic review:
  - CNBV documents the process for receiving and validating regulatory reports; banks ranked by timeliness and quality of delivery.
  - CNBV continuously evaluates sufficiency of information and frequently introduces new reporting requirements (e.g., COVID-19 related templates for classification and provisioning of refinanced and restructured operations).

### Corrective and sanctioning powers (Principle 11, EC1–EC7)
- Early engagement and follow-up (EC1):
  - CNBV communicates continuously with bank management and, when significant, with Boards; issues Oficio de Observaciones at end of examination and Oficio de Medidas Correctivas when corrective actions required.
  - Progress monitored via regular reports; meetings include CNBV supervision vice-president, director general, deputy director general; President of CNBV participates when necessary.
  - LIC Articles 117, 118, 121 and 126 provide framework for actions.
- Range of supervisory tools (EC2, EC4):
  - Possible measures include (non-exhaustive list as applied in practice):
    - present observations and order corrective/remedial actions;
    - impose minimum and additional corrective actions for reestablishment of capitalization (prompt corrective actions regime);
    - require capital restoration plans;
    - limit or order suspension of operations;
    - require adjustments in prudential policies and corporate governance;
    - require adjustments to accounting records;
    - determine and impose fines;
    - order dismissal or temporary suspension of Board members and managers;
    - declare managerial intervention of a bank;
    - decide on entry into Conditional Operation Regime;
    - revoke license in severe/repeated cases (after Board approval and opinions of Banxico and IPAB).
  - Legal references: Art. 50, 122, 129 of the LIC; Art. 6 bis, 7, 25, 28, 29, 122, 128, 129 of CNBV Law; Art. 28 of the LIC.
  - CNBV publishes penalties imposed to entities and individuals on its portal.
- Specific corrective actions for breaches:
  - Capital breaches: minimum corrective measures include board notification, submission of capital restoration plan, suspension of dividend payments, suspension of share repurchases, deferment/cancellation or conversion of subordinated debentures, suspension of certain compensations, abstain from increasing credits to related parties.
  - Additional special corrective measures may include defining concrete actions to avoid capitalization deterioration, contracting external auditors/specialized third parties, abstaining from salary increases, replacement of officials/directors/external auditors.
  - Liquidity breaches: bank must notify CNBV immediately; CNBV may order notification to CNBV and Banxico of causes, board reporting, present a liquidity restoration plan within five business days, suspend dividend payments, limit or prohibit transactions to reestablish compliance.
- Sanctions to individuals (EC5):
  - LIC sanctions and criminal definitions apply to institutions, Board members, shareholders, managers and individuals (Section 5, Chapter II).
- Ring-fencing powers (EC6):
  - Article 74 of the LIC: where parent or economic group actions could affect solvency, liquidity, stability, CNBV may:
    - order additional capital up to 50 percent of minimum capital requirements;
    - suspend all operations with related parties.
  - CNBV can request financial information of related parties and, on failure to provide timely information, may adopt measures above.
  - Limitations exist for unregulated financial conglomerates; ring-fencing options limited (see BCP1 and BCP12).
- Cooperation on resolution (EC7):
  - CNBV actively participates and collaborates with other authorities (IPAB, Banxico, SHCP) to resolve distressed banking institutions.

- Assessment:
  - Principle 11: Largely Compliant.
  - Comments: CNBV emphasizes early detection; CNBV is authorized enforcement agency; IPAB is lead agency for liquidation; ring-fencing options limited for unregulated conglomerates.

### Consolidated supervision (Principle 12, EC1–EC7)
- Understanding group structure and activities (EC1):
  - CNBV understands structure and activities of regulated financial groups authorized under the Law of Financial Groups (LRAF/LAF).
  - As of June 2011, there were 21 regulated financial groups authorized by SHCP under LRAF.
  - HCOs (level 2) are non-operational holding companies; HCOs cannot borrow to leverage capital; no additional prudential rules at HCO level 2 under LAF.
  - CNBV identified seven mixed-activity corporate groups with associated banks that are unregulated and not subject to consolidated supervision; CNBV lacks sufficient understanding of their structure and activities.
  - Example: a parallel bank and unregulated holding company forming a horizontal mixed-activity banking group not consolidated in Mexico.
- Prudential standards at consolidated level (EC2):
  - Authorized financial groups are not subject to prudential regulations at holding level; CNBV’s legal powers limited to banking institution level; SHCP has powers at level 2.
  - Capital adequacy at level 2 is calculated as sum of respective capital needs of members; no precise notional capital charge for unregulated entities.
- Oversight of foreign operations (EC3–EC4):
  - CNBV has legal power to review oversight of banks’ foreign operations; in practice, regulated financial groups operating in Mexico have no material activities abroad.
  - CNBV does not act as home supervisor in practice.
- Review of parent activities (EC5) and limiting group activities (EC6):
  - CNBV has no explicit powers to review activities of unregulated parent companies; cannot confirm power to limit range or locations of group activities for mixed-activity groups as effectively carved out in LIC or LAF.
- Supervision of individual banks in group (EC7):
  - CNBV lacks legal power to supervise banking institutions that operate abroad as part of non-regulated domestic financial groups.
- Assessment:
  - Principle 12: Materially Non-compliant.
  - Comments: LAF did not empower supervisors to impose prudential measures at group level; several domestic conglomerates fall out of scope for consolidated supervision (7 de-facto groups not authorized by SHCP). Authorities recommended to consider legal/regulatory amendments to:
    - (a) apply a comprehensive set of prudential requirements to the financial group as a whole;
    - (b) enforce consolidated supervision to all de-facto Mexican financial conglomerates and include relevant entities, including those operating abroad and those not declared as part of the financial group.

### Home-host relationships (Principle 13, EC1–EC10)
- Supervisory colleges (EC1):
  - No Mexican banking institutions with material cross-border presence requiring CNBV to act as home supervisor.
- Information sharing (EC2):
  - Art. 147 LIC empowers CNBV to exchange information with foreign counterparts based on bilateral MOUs covering public and nonpublic information, surveillance visits, technical assistance.
  - CNBV participates in supervisory colleges of large cross-border firms present in Mexico.
  - Reciprocal inspection visits permitted subject to Mexican legal provisions and MOU terms; access includes AML/CFT information.
  - Bilateral MoUs exist with authorities in Argentina, Canada, Guatemala, Panama, Peru, Spain, The Netherlands, United States, Venezuela; with multiple U.S. federal and state agencies listed.
  - CNBV implemented bilateral mechanism to follow up on foreign institutions’ financial condition with investments in Mexican affiliates via conference calls and formal channels focusing on liquidity, capital, corporate structure.
- Coordination of supervisory activities (EC3–EC4):
  - As host supervisor, Mexican regulation permits overseas supervisors to make on-site visits; CNBV usually participates in on-site visits led by foreign supervisors (FED, ECB examples).
  - No material cross-border operations requiring CNBV as home supervisor, so some ECs not applicable in practice.
- Crisis cooperation and resolution planning (EC5–EC6):
  - Not applicable in practice due to absence of banks with material cross-border presence.
- Prudential treatment of foreign banks (EC7–EC9):
  - Foreign banks subject to same prudential requirements as domestic banks.
  - CNBV reports no impediments to home supervisors’ access for visits and examinations; home supervisors have visited Mexico under MOUs.
  - No shell banks or booking offices in Mexico.
- Consultation before consequential actions (EC10):
  - Case has not materialized.
- Assessment:
  - Principle 13: Compliant.
  - Comments: CNBV active on international cooperation; MOUs facilitate exchange and supervisory coordination.

### Corporate governance (Principle 14, EC1–EC9)
- Legal framework and board responsibilities (EC1, EC5):
  - LIC (Art. 21) and CUB (Chapter VI) extensive on corporate governance.
  - Board responsibilities include approval of objectives of internal control system, establishment/monitoring of risk, internal audit, information systems, conflict of interest minimization, and defining responsibilities.
  - Art. 68 CUB: Board approves risk appetite, strategic plans, comprehensive risk management framework, and risk exposure limits.
  - CUB Article 142 Chapter VI: code of conduct must be sent to CNBV within ten working days of Board approval.
- Assessment and supervisory review (EC2–EC4):
  - CNBV assesses corporate governance through Institutional Supervisory Handbook (MIS) and CEFER; evaluates Board members and senior management, performance review of internal control.
  - Board composition requirements (LIC Arts. 10, 22–24):
    - Board minimum 5, maximum 15 members; at least 25 percent must be independent.
    - Majority must be Mexicans or foreign residents.
    - Potential board members must meet criteria: technical knowledge, honesty, satisfactory credit history, experience.
    - Ineligibles listed (employees except CEO, litigants with bank, convicted for financial crime, undischarged bankrupts, bank supervisors).
  - Banking entities mandated to have audit, risk, and human resources committees; performance regularly assessed by CNBV.
- Fit and proper and appointment powers (EC6, EC9):
  - Art. 24 LIC: appointments of general director and officers immediately below require eligibility and five years of high decision-making experience.
  - CNBV pre-approves CEO as part of authorization process; CNBV must approve new board members but not subsequent CEOs or senior management (though CNBV can remove them).
  - Art. 25 LIC: CNBV empowered to order suspension, removal or destitution of directors or officers; can impose suspension from three months up to five years for serious/reiterated violations.
- Compensation oversight (EC7):
  - Regulatory compensation regime incorporates FSB Principles and Implementation Standards.
  - Board approves remuneration system; policies may align compensation with prudent risk-taking and include deferral or adjustment mechanisms (CUB Section 8, Chapter VI).
- Board understanding of structure and risks (EC8):
  - CNBV examines board minutes and committee minutes to form view of management and oversight.
- Assessment:
  - Principle 14: Largely Compliant.
  - Comments: Laws and regulations are extensive; assessment quality could be enhanced by giving more prominence to expert judgement on timeliness/quality of board data, directors’ time commitment, and collective suitability and patterns of board discussions.

### Risk management process (Principle 15, EC1–EC14)
- Legal and institutional framework (EC1–EC3):
  - Art. 65 LIC empowers CNBV to issue regulations on credit and overall risk management; CUB Articles 68 et seq establish risk management framework centered on the risk committee (Article 70).
  - Board approves objectives/guidelines/policies/limits; risk committee ensures observance; risk management unit identifies/measures/monitors/reports; CEO ensures independence between risk unit and business units.
  - Risk committee composition and functions (Articles 70–72 LIC/CUB):
    - At least two directors, CEO, heads of risk management and internal audit; heads attend advisory only.
    - Propose objectives, guidelines, policies, limits; approve methodologies/models; appoint/remove CRO; quarterly reporting to board; ensure staff knowledge of limits.
  - Risk management unit (Articles 73–74 CUB):
    - Independent from business units; propose methodologies; monitor observance of limits; provide information to risk committee, CEO, business unit managers including sensitivity analysis and corrective proposals.
  - CNBV assesses risk management via CEFER reviews and on-site inspections; CEFER includes 10 principles (capital planning, model validation, stress testing, etc.).
  - Banks must perform yearly internal audit review and technical evaluation by management of overall risk management (Articles 76–77 CUB).
  - Proportionality: CNBV reduces frequency of review for less significant institutions.
- Bank-wide risk management and specific risks (EC2, EC11):
  - Article 67 mandates policies/procedures to manage quantifiable and non-quantifiable risks, roles/responsibilities, identification/measurement/monitoring; Articles 79–86 detail requirements for credit, liquidity, market, operational risk; Article 87 mandates risk information systems; Article 88 requires related public disclosures.
  - Liquidity requirements (LCR and NSFR) regulated separately in Liquidity requirements regulation.
- Documentation, review and communication (EC3–EC4):
  - Article 78 CUB requires proper documentation of policies, limits, governance, reporting frequency and procedures to approve new products or limit exceptions.
  - Risk management unit reports monthly to risk committee, CEO and business units; quarterly to board. Risk committee must meet at least monthly.
  - Board reviews limits and ICAAP coherence at least annually.
- Internal capital and liquidity adequacy (EC5):
  - Article 50 Bis LIC requires at least annual evaluation (ESC) of capital sufficiency under scenarios including adverse scenarios; banks prepare Preventive Action Plan (PAP) if capital insufficient.
  - CNBV implementing regulation (Chapter VI Bis and Annex 12-D) details ESC requirements including scenarios/shocks (adverse movements in asset prices including foreign currency denominated; financing stress including deposit withdrawals; rating downgrades; increase in volatility; etc.).
  - Article 81 CUB requires banks to estimate potential losses from forced sales or inability to renew liabilities and prepare plan for unexpected financing needs.
- Models and validation (EC6):
  - Article 75b CUB: risk management units must yearly assess suitability of internal models and report to risk committee; monthly checks that observed exposure match estimates.
  - Internal audit yearly reviews model documentation and IT systems (Article 76 CUB).
  - CNBV technical experts review and validate internal models and perform parallel calculations; internal models for credit risk and deposit stability for market risk must comply with CUB and be approved by CNBV.
- Information systems and resources (EC7, EC9, EC10):
  - Adequacy of information systems assessed via annual off-site review, on-site inspections and specialized inspections; CNBV has conducted inspections identifying remedial measures for data quality and spreadsheet reliance.
  - Risk management unit must be independent, report directly to risk committee and board; internal audit annually reviews risk management.
  - All banks required to have a dedicated risk management unit headed by CRO; banks report CRO appointment within five days and removal within ten days with reasons.
- New products, contingency and recovery (EC8, EC12):
  - Procedures for new products must include risk analysis, cost/benefit, methodology for risk identification/measurement/control/reporting, legal feasibility; risk committee approves.
  - Banks must prepare funding contingency plans (PFC) and recovery plans (Planes de Contingencia); CNBV approves plans (non-binding opinion of IPAB, Banxico, SHCP for recovery plans).
  - D-DIBs submit recovery plan annually; other banks submit every two years.
  - Business continuity plans required (Article 164 Bis CUB).
- Stress testing (EC13):
  - Stress testing required yearly by CNBV to assess capital adequacy and inform planning, risk profile, exposure limits, and risk tolerance.
  - Banks must inform CNBV of main stress test elements prior to exercise; CNBV may mandate modifications or more frequent testing.
  - Stress tests must comply with CUB Annex 12-B, be approved by risk committee, documented, and methodology reviewed yearly.
- Internal pricing and new product approvals (EC14):
  - CUB establishes obligations to allocate liquidity costs and incorporate risk impacts into pricing; risk committee must approve methodologies for identification/evaluation/measurement/control of risks of new operations.
- Assessment:
  - Principle 15: Largely Compliant.
  - Comments: Regulations comprehensive; compliance assessment could place greater emphasis on quality of risk management rather than formal compliance; consider proportionality between large/complex banks and smaller banks.

### Capital adequacy (Principle 16, EC1)
- Legal basis and minimum requirements:
  - Article 50 LIC mandates banks to operate at all times with minimum net CAR and empowers CNBV to issue implementing regulation.
  - CUB Articles 2 Bis to 2 Bis 120 require a minimum 8 percent of the sum of equivalent risk-weighted assets for credit risk, market risk, and operational risk.
  - CNBV empowered to define components of capital and require conservation, systemic, and countercyclical buffers; must hear Banxico opinion when modifying components.
- Components and buffers (aligned with Basel definitions):
  - 4.5 percent CET1 (Capital Fundamental)
  - 6.0 percent AT1 (Capital Básico No Fundamental)
  - 8.0 percent T2 (Capital Complementario)
  - 2.5 percent Capital Conservation Buffer
  - 0–2.5 percent Countercyclical Buffer
  - 0.6 percent–2.25 percent Systemic buffer for Mexican D-SIBs
- Composition details:
  - Capital Neto (T1 and T2) includes capital contributions, retained earnings, capital reserves; add/subtract items (convertible shares, eligible subordinated debt up to a 15 percent CET1 limit, deductions for investments in banks’ equity, subordinated debt, shares of related companies, 50 percent of investments in DBs, shares in companies that are shareholders of the bank, loans to buy own shares, credits to related parties beyond 25 percent limit, intangible assets).
  - T2 includes eligible capital instruments and 0.6 percent (IRB users) or 1.25 percent (standardized approach) of general credit risk provisions.
  - Subordinated debt converted when CET1 reaches thresholds (5.125 percent for instruments in AT1 or 4.5 percent in T2).
- Overall requirement example:
  - Including the conservation buffer and with countercyclical buffer at 0 percent, all Mexican banks are subject to a 10.5 percent capital requirement.
  - D-SIB systemic requirement ranges from 0.6 percent to 2.25 percent depending on systemic impact; six systemic banks grouped into four categories with buffers from 0.6 percent to 1.5 percent in 0.3 pp tranches; category V (empty) would have 2.25 percent buffer.
- Calculation and classification:
  - Calculation of capital requirements detailed in CUB Articles 2 Bis 10 to 2 Bis 117.
  - Banxico calculates CARs with bank-submitted information and sends monthly CARs to CNBV for publication.
  - CNBV classifies banks into 5 categories according to capital situation with corresponding preventive and corrective measures (Articles 222–237 CUB):
    - Category II measures: detailed report, capital conservation plan, restrict related-party operations, partial restrictions on dividends/bonuses.
    - Category III measures: capital restoration plan, suspension of dividends and purchase of own shares, suspension of bonuses, deferral/conversion of subordinated bonds.
    - Categories IV and V measures: ban on new investments in non-financial assets/new activities, removal of managers and directors, limit interest paid to depositors.
- Current system status:
  - Currently, all banks are in Category I.
  - Banking system median CAR: 18.65 percent.
  - The five biggest banks, holding 67 percent of system assets, operate with CARs that range from 13.68 percent to 24.44 percent; and CET1, from 11.23 percent to [text truncated in source].

*Source: Chapter II of title Three of the CUB, Articles 175 Bis to 175 Bis 8).*

### 16.35 percent.

### 1mexea2023002 - 16.35 percent.

### Capital framework and aggregate figures
- Total risk weighted assets amounted in June 2022 to MXN7.75 Trillion.
- Risk composition of total RWA (June 2022):
  - 70 percent: credit risk
  - 20 percent: market risk (calculated for both the banking book and the trading book)
  - 10 percent: operational risk
- Most banks in Mexico apply standardized methods for credit, market and operational risks; internal methods may be authorized by CNBV for credit and market risks.
- CNBV has approved the use of 28 IRB credit risk models to six banks, for limited portfolios (corporates, mortgages, consumer, credit cards, banks, SMEs).
- No bank has applied for the advanced measurement approach for market risk.
- Market risk capital charge under the standardized approach incorporates a charge for market risk in the full banking book, calculated by applying standard VaR based coefficients to that broader book; CNBV indicates this approximates an interest rate risk in the banking book (IRRBB) charge and on average amounts to about what would be required for market risk in the trading book.
- Capital requirements for market risk are calculated using a standardized method.
- Capital requirements for operational risk will transition from the current Basel II standardized approach to the Basel III method starting in January 2023.

### Leverage and disclosure
- Banks are to monthly publish their leverage ratio.
- Article 172 Bis 39 CUB establishes a 3% soft minimum leverage requirement, defining this level of the ratio as ‘sound banking practice’.

### Alignment with Basel and scope of application (EC2)
- For internationally active banks, the definition of capital, risk coverage, method of calculation and thresholds for prescribed requirements are not lower than applicable Basel standards.
- Capital requirements (definition of capital, risk coverage, method of calculation, and thresholds) in Mexico are aligned with Basel standards and apply to all banking institutions.

### Supervisory powers on capital (EC3, EC4)
- Article 50 of the LIC requires all banks to maintain capital for credit risk, market risk, and operational risk and empowers CNBV to impose specific capital requirements on all risks (both on- and off-balance sheet).
- Article 2 Bis 117, CUB: CNBV, hearing the opinion of Banxico, may require an additional capital charge to any bank based on composition of assets, internal control efficiency, risk exposure and risk management, or deficiencies in policy implementation and risk recognition.
- Article 2 Bis 54, CUB: CNBV may assess banks' securitization positions and determine whether capital requirements or adjustments are needed.
- CNBV has not yet imposed Pillar 2 requirements to any bank.
- Modulation of capital according to risk profile and systemic relevance is achieved through the D-SIB buffer.
- During the COVID pandemic CNBV permitted banks to use up to 50 percent of the capital conservation buffer; banks had to explain reasons and strategies to reestablish regulatory capital levels.

### Use and oversight of internal models (EC5)
- Articles 2 Bis 65, et seq, and Annexes of the CUB set requirements to obtain CNBV authorization to use IRB models for credit risk; both foundation and advanced approaches are allowed.
- Authorization process requirements:
  - Bank self-assessment, approved by the CEO, on compliance with CUB.
  - Parallel run: applicant bank must run the model in parallel with the standard approach for the prior three years before applying and submit both results to CNBV.
  - After approval, parallel run must continue for another three-year period (which CNBV can extend).
  - CNBV may order amendments, suspend use of IRB models, or revoke authorization.
- Banks using IRB models must comply with minimum standards, including:
  - Internal rating systems providing statistically significant borrower assessment and relevant segmentation of risk.
  - Comprehensive risk parameter estimation processes generating accurate, timely, and reliable estimators.
  - Systems validating accuracy and consistency of rating processes and estimation of relevant risk components; internal validation must be independent from model development.
  - Annual internal audit review of rating system performance and risk parameter estimation.
  - Development and implementation approvals by corresponding collegiate bodies designated by the board.
- CNBV assesses performance of internal rating systems, may request information, and if minimum requirements are not met, requires a CNBV-approved correction plan; CNBV may require more capital or mandate return to the standard method.

### Forward‑looking capital management and stress testing (EC6, ICAAP)
- Banks are required to assess capital adequacy at least annually, including stressed scenarios (Article 50 Bis, CUB).
- Banks must evaluate general capital and liquidity adequacy relative to risk appetite and business strategy and submit assessments to CNBV, which must include estimation of capital for the next 10 quarters in each scenario and possible deviations from risk limits and risk appetite.
- In case of capital shortfalls, banks must submit to CNBV a capitalization plan with corrective actions and estimated financial projections of implementation, and provide periodic progress reports.
- Within ICAAP, capital adequacy is assessed in the annual stress test under supervisory scenarios; CNBV verifies sufficiency of regulatory capital to operate in the short and medium terms in an adverse but feasible scenario.
  - Stress test is mandatory for all banks but grouped into three levels of systemic importance with different complexity levels applied.
  - Prior to the stress test, banks submit main elements (risks, scenarios, assumptions); CNBV may require modifications to stress test design, analyzes projections, discusses concerns, and may make observations.
  - Supervisory reports include observations to banks concerning scope and emphasis on different risks.
- On- and off-site supervisory review checks banks’ policies and processes to monitor implementation of CAR, discusses deviations with senior management, and reviews quality of information, internal controls, information flow to the board, role of risk management unit, and governance of correction plans or supervisory corrective measures.

### Assessment of Principle 16
- Overall assessment: Largely Compliant.
- Key points:
  - Mexico has a capital framework broadly consistent with the Basel framework.
  - Capital framework is applied to all credit institutions on a solo basis; Mexican banks must deduct all investments and possible capital shortages in financial subsidiaries from CET1, which the assessment notes is probably more demanding than the consolidated calculation.
  - CNBV appears to have adequate powers to apply Pillar 2 charges but has not exercised these powers to date.
  - The assessment team encourages CNBV to sharpen the CEFER tool prior to applying Pillar 2, capital expectations, or other corrective actions.

### Credit risk framework introduction (Principle 17, EC1)
- Article 65 of the LIC authorizes CNBV to issue prudential regulations on risk management; Article 76 empowers CNBV to issue detailed rules on credit risk (classification, provisioning, documentation for credit origination and renewal).
- CNBV has issued detailed rules covering the full credit cycle:
  - Underwriting and evaluation: Articles 14 to 21, CUB
  - Management and monitoring: Articles 22 to 29, CUB
  - Internal audit and control standards: Articles 30 to 32, CUB
- CNBV is the accounting regulator for Mexican supervised institutions (CUB).

*Source: 1mexea2023002 - 16.35 percent.*

### Annex 33 Accounting Standard B-6 "Loan Portfolio").

### Annex 33 Accounting Standard B-6 "Loan Portfolio"

### Governance and board-level responsibilities
- Per Articles 66, 68 and 78, CUB, banks’ boards are required to annually approve the banks' risk appetite, which must consider exposure to credit risk.
- Articles 7 and 25, CUB, require that banks’ boards of directors approve the objectives, guidelines and policies for credit origination and management, which must be consisted with, and complementary to, those detailed in the comprehensive risk management framework.
- The board appoints the committees or employees responsible for developing these guidelines and policies and is responsible for effectively reviewing and approving each year the objectives, guidelines and policies related to credit risk.
- Article 68 CUB establishes that the banks’ boards are responsible for approving the desired risk profile, the comprehensive framework for risk management, the risk exposure limits, the risk tolerance levels, and the mechanisms to apply corrective actions and contingency plans.
- Per Article 6 CUB, the CEO is responsible for ensuring coherence between objectives, policies, support infrastructure, origination, and ongoing management. The CEO must report annually to the board of directors any threat from deviations from the credit strategy and the measures adopted to address them, as well as the human, material and financial resources that are allocated to ensure proper management of the credit portfolio.

### Minimum policy and procedure requirements
- At a minimum, the policies and procedures must address limits on total credit exposures, limits for exposures to a single party or group of connected parties, and adequate monitoring of the nature, characteristics, diversification and quality of the credit portfolio.
- Banks must quantify, assess and monitor credit risk concentration by type of product, rating, economic sector, geographic location, and debtor.
- Banks must monitor the evolution and potential deterioration of the loan portfolio, assess the probability of default of each debtor and the expected losses of the entire loan portfolio.
- Banks must forecast unexpected losses for the entire credit portfolio and compare them with observed losses (Article 80, CUB).
- Article 9 CUB instructs banks to have credit manuals, with policies, procedures, information, and methodologies for risk origination and risk management, which have to be coherent with the comprehensive risk management framework. CEOs are responsible for ensuring that the credit manual is properly implemented and applied.
- Articles 3–13 CUB describes the minimum guidelines that banks must comply regarding their credit risk activities: organization, phases, policies, delegations and committees for credit approval, infrastructure and controls, credit origination and analysis, loan administration, internal functions, responsibilities and delegations, loan recovery, and detailed internal audit review.
- Articles 14 to 21 pertain credit origination. Banks must carry out the evaluation and analysis of credit proposals differentiating among the different portfolio type and their risk, considering, inter alia, payment experience, payment capacity, and solvency of the borrowers. All credits must be approved by the board, which can delegate to committees, business units, or individuals. Refinancing operations must follow the same steps that new ones.
- Articles 22 to 32 pertain credit management and monitoring, including internal control and internal audit. Banks are obliged to permanently monitor relevant information, such as the status of guarantees, documentation, borrower’s capacity and willingness to pay; flagging problem exposures and developing specific and strict policies to deal with these credits based on the type, amount and days in arrears.
- Article 12 CUB instructs banks to have credit management information systems for the different steps of the credit process. At a minimum, they must generate reliable reports, avoid multiple entries and data manipulation, provide automatic, timely and transparent accounting reconciliation. Additionally, the information systems must provide the necessary information for decision-making to the board, the CEO, and the business areas in charge of the credit operation.
- Banks must adhere to the credit portfolio rating processes and capital requirements for credit risk, established in the CUB. Banks that wish to apply internal methodologies to classify certain portfolios and determine capital requirements for credit risk, must request authorization from CNBV and comply with the minimum model requirements detailed in [text ends].

### Supervisory review, CNBV practices, and assessment findings (EC2 / EC3)
- CNBV assesses credit risk management processes and policies through specialized on-site inspections of banks’ activities and the evaluation of the annual reports issued by the risk management and internal audit units, which are reviewed periodically by supervisors with the adequate expertise. Working papers are reviewed ex-post by supervisors during on-site inspections.
- CNBV carries out a review of some aspects of credit risk of every bank every year, including risk classification and provisioning. In this review normally all credit segments are evaluated, including the associated credit risk processes, from strategy to policies and systems.
- After the review, CNBV initiates formal or informal actions, as warranted, and follows up—through on- and off-site work—to ensure that the deficiencies are addressed.
- The supervisor determines that a bank’s Board approves, and regularly reviews, the credit risk management strategy and significant policies and processes for assuming,57 identifying, measuring, evaluating, monitoring, reporting and controlling or mitigating credit risk (including counterparty credit risk and associated potential future exposure) and that these are consistent with the risk appetite set by the Board. The supervisor also determines that senior management implements the credit risk strategy approved by the Board and develops the aforementioned policies and processes.
- Description and findings of EC2: Banks’ boards are responsible for approving and annually reviewing the objectives, guidelines and policies for credit underwriting and management, which must be consistent, compatible and complementary to those established for comprehensive risk management, in accordance with Article 7 CUB. Banks must develop and have policies and processes to identify, assess, monitor, disclose, control and mitigate credit risk.
- In addition to monitoring compliance with the above provisions, CNBV performs the following activities during the supervisory review:
  - Verify that the policies and procedures to be submitted board’s approval are consistent with the bank's risk profile and appetite.
  - Verify that senior management is effectively implementing the credit risk strategy approved by the board.
  - Review the evidence of the actions carried out by the risk committee and the audit committee for the fulfillment of their functions.
  - Review the reports and opinions of the internal audit.
  - Assess compliance of credit risk management procedures with the applicable rules.
  - Verify the proper implementation of regulatory changes regarding credit risk rating, such as e.g., IFRS9.
  - Review of the minutes of the committees and boards to validate the correct identification and monitoring of credit risks.
  - Validation of compliance with regulatory risk limits: operations with related parties and credit risk concentration.
- EC3 expectations for policies and processes:
  - (a) a well-documented and effectively implemented strategy and sound policies and processes for assuming credit risk, without undue reliance on external credit assessments;
  - (b) well defined criteria and policies and processes for approving new exposures (including prudent underwriting standards) as well as for renewing and refinancing existing exposures, and identifying the appropriate approval authority for the size and complexity of the exposures;
  - (c) effective credit administration policies and processes, including continued analysis of a borrower’s ability and willingness to repay under the terms of the debt (including review of the performance of underlying assets in the case of securitization exposures); monitoring of documentation, legal covenants, contractual requirements, collateral and other forms of credit risk mitigation; and an appropriate asset grading or classification system;
  - (d) effective information systems for accurate and timely identification, aggregation and reporting of credit risk exposures to the bank’s Board and senior management on an ongoing basis;
  - (e) prudent and appropriate credit limits, consistent with the bank’s risk appetite, risk profile and capital strength, which are understood by, and regularly communicated to, relevant staff;
  - (f) exception tracking and reporting processes that ensure prompt action at the appropriate level of the bank’s senior management or Board where necessary; and
  - (g) effective controls (including in respect of the quality, reliability and relevancy of data and in respect of validation procedures) around the use of models to identify and measure credit risk and set limits.
- Description and findings of EC3: The CUB contains CNBV’s guidelines to ensure that banks have documented policies, methodologies and procedures for each of the stages of the credit process conducive to adequate credit risk management systems. Supervisors review the reports submitted by the CEO to the board and during credit risk inspection visits.
- CNBV checks compliance through review of reports submitted by the CEO and the credit committee to the board, and during credit risk inspection visits. CNBV assesses whether the processes and methodologies in place are consistent with the objectives and guidelines approved by the board, and aligned with the risk appetite of the bank.
- CNBV determines the effectiveness of the banks' information systems, in order to assess the adequacy and timeliness of the identification, aggregation and reporting of exposures to credit risk, through the reviews carried out in the inspection visits. Supervisors validate that the information contained in the information systems, is consistent with the operational information, and that the information presented to the different collegiate and managerial bodies is adequate, timely and accurate. The supervisory reports reviewed by the assessors included observations on risk classification and provisioning, as well as reporting, and management practices.
- Supervisors review and verify compliance with prudential and internal limits of capital consumption for credit risk approved by each bank, through inspection visits and review of the minutes of the board, and the credit and risk committees.
- Risk committees, with prior authorization from the board, may adjust or approve exceptions to the risk limits. The risk function, independently from business units, is required to report any deviation from the approved limits to the bank's CEO and the risk committee, explaining the causes and impact, to apply corrective actions.

_Annex 33 Accounting Standard B-6 "Loan Portfolio")._

### Annex 15 CUB. The CUB restricts the use of internal rating models to consumer loans and

### Annex 15 CUB. The CUB restricts the use of internal rating models to consumer loans and corporate loans up to UDI 2 million (equivalent to MXN270,000).

### Use of internal rating models and CNBV authorization
- The CUB restricts the use of internal rating models to consumer loans and corporate loans up to UDI 2 million (equivalent to MXN270,000).
- As part of authorization and during use of these models, CNBV evaluates that banks have effective controls that allow an adequate identification and measurement of credit risks.
- Models have to be authorized by CNBV and cannot refer to credit to the public sector and project finance.
- For retail loans (consumer revolving and nonrevolving, and household mortgages) three eligible methodologies are allowed:
  - a generalized parametric algorithm estimated by CNBV;
  - CNBV approved internal methods developed by an institution;
  - risk parameters used as part of a CNBV approved IRB capital model developed by an institution.

### Monitoring total indebtedness and risk factors (EC4)
- CNBV determines banks have policies and processes to monitor total indebtedness and risk factors that may result in default including significant unhedged foreign exchange risk.
- Article 15 CUB establishes minimum elements intermediaries must consider to assess and, where appropriate, approve credits.
  - Section III, Subparagraph a), Numbers 1 and 3 instruct banks to take into account total indebtedness using reports prepared by credit bureaus no older than three months.
  - Banks must analyze financial information, assess creditworthiness, verify credit history, and assess collateral and guarantors.
- CNBV evaluates methodologies and practices used by banks in credit origination, monitoring and recovery through on- or off-site supervision, including validation of criteria to analyze borrower payment ability.

### Conflicts of interest and arm’s length lending (EC5)
- Supervisor requires banks make credit decisions free of conflicts of interest and on an arm’s length basis.
- Relevant provisions:
  - Articles 3, 4, 8, 14, 17 and 19 CUB require lending free of conflicts of interest.
  - Article 73 LIC requires related-party operations be agreed under terms no more favorable than similar operations with the general public.
  - Article 128 LIC empowers CNBV to order suspension or partial limitation of operations if they entail a conflict of interest to clients’ detriment.
- Supervisory practice:
  - PIN specifies tasks to review banks’ monitoring and follow-up of conflicts of interest.
  - Supervisors review related party loan reports, cross-checked against credit risk committee or board documentation, using certifications and on-site inspection working papers.

### Approval thresholds for major credit exposures (EC6)
- Articles 15 and 17 CUB require that loans to groups of connected clients exceeding 10 percent of banks’ Tier 1 capital or UDI30 million (around USD11 million equivalent) and having maturity > one year be approved by officers not lower than the second hierarchy level within the credit function; in practice most banks refer such exposures to the board.
- Mexican regulatory framework does not otherwise require board approval for major or especially risky exposures.

### Access to information (EC7)
- Article 19 of the LCNBV grants CNBV full access to information and bank officers involved in credit risk.
- CNBV confirms unrestricted access and no cases of denial were reported to assessors.
- For foreign-incorporated financial institution subsidiaries of Mexican parents, CNBV performs on-site inspections together with local supervisors about every other year.

### Stress testing requirements (EC8)
- Supervisor requires banks to include credit risk exposures in stress testing programs for risk management purposes.
- Stress test features:
  - Tools to warn management of possible adverse impacts and assess capacity to absorb potential losses.
  - Scope and assumptions must be approved by the risk committee and documented in comprehensive risk management manuals.
  - Institutions must review suitability and correct use of stress tests at least once a year.
- CUB Annex 12-B details minimum requirements for each risk for stress testing.
- CNBV annual supervisory stress test includes assessment of all material risks in relation to strategy, risk appetite and capital planning, taking into account a three-year horizon.

### Assessment of Principle 17
- Compliance status: Compliant
- Comment:
  - CNBV has an adequate regulatory and supervisory framework for credit risk, emphasizes credit risk, and performs on-site verification of credit files and bank borrower analysis.
  - A threshold is not established for large or especially risky loans that must be approved by the board.

### Principle 18 — Problem assets, provisions and reserves: regulatory framework (EC1 summary)
- CNBV has authority over accounting aspects for financial instruments involving credit risk.
- Article 65 LIC: banks must adopt policies and procedures to manage credit risk, including problem loans.
- Article 76 LIC: CNBV empowered to regulate classification and provisioning of credits—seeking Banxico’s opinion.
- CUB requirements:
  - Articles 3 to 44: organize and control active operations, including reserve for problem loans.
  - Articles 45 to 51 Bis 14: maintain credit files with minimum debtor information.
  - Articles 52 to 61 and Articles 63 and 64: risk diversification and identification of groups of connected parties as ‘common risk’.
  - Articles 89 bis to 139 Bis 7 to 89 Bis: credit classification and provisioning based on significant increase in credit risk (SICR); classification in stages 1, 2, or 3.
- Classification and provisioning methodologies:
  - Standard methodology (Articles 91 to 138) or internally developed methodology (Articles 139 Bis to 139 Bis 7), basic or advanced.
  - For exposures of UDI 2 million or higher (about USD0.6 million), institutions must undertake an individual classification process based on borrower rating and transaction rating (Articles 115 to 123; annexes 18 to 19).
  - All loans graded map to a master scale of nine classes A-1 to E (Article 129).
- Loan loss reserves (LLR) follow Loss provisions = PD * LGD * EAD.
  - Required provisions are expected loss (EL) to a twelve-month horizon (stage 1) or lifetime (stages 2 and 3).
  - Point in time PDs for stages 1 and 2; 100 percent PD for stage 3.
  - LGD estimates for retail portfolios range from 60 to 75 percent; after mandated payments in arrears consumer loans attract a 100 percent LGD.
  - Repossessed assets provisioning: full coverage in 30 months for moveable assets, and 5 years for real estate (Article 132).
- Annexes 13 to 27 provide additional guidelines and criteria for classification and debtor analysis; Annex 33 Section B-6 provides accounting definitions and tests for loan restructurings and transfers among stages.

### Supervisor’s role in provisioning and classification oversight (EC2–EC7)
- EC2: CNBV may require additional loan loss reserves per Article 107 LIC and assess asset quality and establish provisioning levels (Article 17, section III RICNBV).
  - CNBV determines suitability of policies and procedures through off-site monitoring, evaluation of risk management and internal audit reports, and on-site reviews per the annual inspection program.
  - On-site reviews and individual loan reviews follow mandated procedures in CNBV’s Institutional Manual for Supervision; CNBV can require reclassification and additional provisions and follows up on remediation on- and off-site.
- EC3: Off-balance sheet exposures included in classification and provisioning as mandated by Article 76 LIC; credit risk from off-balance-sheet exposures calculated as replacement value and its changes throughout remaining maturity.
- EC4: Banks must periodically assess whether credits in stage 3 must be written off according to internal policies; interest on stage 3 credits is not recognized in income statement but through off-balance sheet.
- EC5: Supervisor tests banks’ treatment of deteriorating assets to detect circumvention (rescheduling, refinancing, reclassification); banks must have organisational resources for early identification and collection.
- EC6: CNBV obtains regular detailed information on classification and provisioning; Article 207 CUB and report R04 require monthly submission of credit risk parameters; articles 48 and 49 CUB require credit files as per Annexes 2 to 10; Articles 110 to 115 require portfolio information with necessary detail to determine reserves.
  - CNBV frequently updates reporting templates, including COVID-19 related refinancing monitoring.
- EC7: CNBV has powers to require asset reclassification and additional provisions (Article 136 CUB; Article 102 LIC); Articles 39 and 51 CUB allow additional provisions when originated through defective credit process or improperly documented or conflicts of interest exist.
  - CNBV conducts frequent on-site inspections assessing asset classification, provisioning, collateral valuation, and documentation; may impose additional measures if warranted.

### Valuation of risk mitigants and collateral (EC8)
- Banks must have mechanisms to assess value of credit risk mitigants and hedged portion of exposures (Articles 15 and 22 CUB).
- Mortgage guarantee valuation:
  - Assessed at least every 3 years, or annually when adverse conditions in the area exist or when prices drop by 10 percent per year.
- Credit risk mitigants (guarantees, credit derivatives, collateral) eligible for reduction of provisions and capital requirements if they meet Annexes 24 and 25 CUB, aligned with Basel standards.
- Valuation approaches:
  - Consumer and mortgage loans: collateral valued according to a parametric method accounting for market value.
  - Commercial loans: valuation according to bank-established valuation policies.
- Repossessed assets provisioning: full coverage in five (real estate) or 2.5 years (movable collateral).

### Identification and reclassification criteria for problem assets (EC9)
- CUB, Annex 33 Accounting Standard B-6 “Loan Portfolio” requires disclosures about accounting policies and methods used to identify problem commercial loans whether current or overdue; problem portfolio defined as loans with significant probability principal and interest will not be recovered in full regardless of classification as current or past due.
- Restructured loans are deemed in stage 3 and kept as past-due if they fail the sustained service payment test of three consecutive monthly payments, or one for installments longer than 60 days.
- Section B-6 provides test of effective payment, precluding indirect refinancing of arrears: requires full payment of due interest and a 20 percent reduction of principal.

*Source: Annex 15 CUB — selected sections on internal rating models, supervisory assessments EC4–EC9, and Principles 17–18 from the provided IMF document.*

### Annex 33 of the CUB, Accounting Standards B-6 "Loan Portfolio", paragraphs 9, 11 and

### Annex 33 of the CUB, Accounting Standards B-6 "Loan Portfolio", paragraphs 9, 11 and 105

### Definitions of problem and overdue loans
- "Problem loans" are defined as commercial loans with significant chance, based on current facts and information, to not fully recover capital or interest, as agreed in the original terms and conditions.
- Overdue loans are defined as those whose principal, interest or both have not been paid as originally agreed, as well as those granted to borrowers declared insolvent, except in cases in which, in accordance with the bankruptcy law, it is more likely than not that the bank will continue to receive the payment of those loans.
- Overdue loans whose balances pending payment (principal and interest, among others) are paid in full, and those restructured or renewed that, together with the assessment of the ability of the debtor to repay, meet the sustained payment condition of the loan can be reclassified as performing loans.

### EC10 — Reporting to Board and supervisory verification
- Minimum information the supervisor determines the bank’s Board must obtain on asset portfolio condition includes:
  - classification of assets;
  - the level of provisions and reserves;
  - major problem assets;
  - summary results of the latest asset review process;
  - comparative trends in the overall quality of problem assets;
  - measurements of existing or anticipated deterioration in asset quality and losses expected to be incurred.
- Description and findings:
  - Articles 26 and 74 of the CUB require the Comprehensive Risk Management Unit to report at least monthly to the risk committee and senior management on portfolio quality, risk evolution and profitability, considering all operations with credit risk, results of analysis and projections, and reserves.
  - Reports include sensitivity analysis and tests under different scenarios, evolution of risks, deviations from the risk appetite level and analysis of drivers and persistence, and the impact on capital.
  - At least quarterly, reports must be made to the board; deviations from exposure limits require immediate notification to senior management and the risk committee.
  - Through off-site supervision and review of governing body minutes, supervisors verify quarterly how the risk committee sends information (time and content) to the board, including on problematic assets, and monitor corrective actions taken by banks.

### EC11 — Individual valuation, classification and provisioning for significant exposures
- Supervisor requirement:
  - Valuation, classification and provisioning, at least for significant exposures, are conducted on an individual item basis.
  - Supervisors require banks to set an appropriate threshold for identifying significant exposures and to regularly review the threshold level.
- Description and findings:
  - Article 15: for commercial credits equal to or greater than 2 million UDIS (around USD 685,000), banks must consider multiple quantitative and qualitative evaluation aspects, review of the payment date before the term (own source of payment credits), review of limits for operations under the concept of common risk and other specific conditions to be reviewed by the Board.
  - In origination, Article 15 CUB mandates sensitivity tests for loans that represent 10 percent or more of the bank's Tier 1 capital.
  - Through periodic on-site inspections, CNBV evaluates that valuation, classification and provisioning for significant exposures, by sampling procedure, are carried out individually.

### EC12 — Sectoral/system-wide trend and concentration assessment
- Supervisor role:
  - Regularly assess trends and concentrations in risk and risk build-up across the banking sector in relation to banks’ problem assets.
  - Take into account concentration in banks’ risk mitigation strategies and potential effects on mitigant efficacy.
  - Consider adequacy of provisions and reserves at bank and system level.
- Description and findings:
  - CNBV reviews and assesses credit risk portfolio quality of individual banks using off-site and on-site inputs, enabling comparison with peer group and banking system.
  - Supervisors can compare classification of the same counterparty across banks.
  - CNBV’s portal analysis includes credit growth (volume and number of creditors) broken down by portfolios; risk concentration, including analysis of the system’s 25 biggest debtors and of each bank (including the impact in the CAR of the default of the 5 biggest); exposures to vulnerable or weak economic sectors; vintage and cluster analysis; default rates and expected losses.
  - A specialized CNBV unit produces monthly portfolio risk information on increases/decreases in loan amounts, trends and concentrations of risk, and evolution of expected losses.

### Assessment of Principle 18
- Compliant
- Comments:
  - Mexican laws and CNBV’s regulations provide a detailed framework for identification and management of problem assets, asset classification, provisioning and write-offs.
  - When CNBV observes deficiencies or weaknesses in credit risk classification and provisioning, or in reporting to CNBV, supervisory action is undertaken as described above.

### Principle 19 — Concentration risk and large exposure limits (overview)
- Supervisor determines banks have adequate policies/processes to identify, measure, evaluate, monitor, report and control or mitigate concentrations of risk on a timely basis.
- Supervisors set prudential limits to restrict bank exposures to single counterparties or groups of connected counterparties.

### EC1 — Bank-wide view and management of concentration risk
- Laws/regulations require banks to have policies/processes providing comprehensive bank-wide view of significant concentration sources; capture exposures from off-balance sheet and on-balance sheet items and contingent liabilities.
- Description and findings:
  - Article 66 CUB defines concentration as high and disproportionate exposure to particular risk factors within same category or between different risk categories; Article 65 CUB requires banks to measure, assess and monitor concentration by financing type, rating, economic sector, geographical area and debtor.
  - Article 86 Bis CUB minimum requirements include:
    - Consider concentration by debtors, counterparty or group of related counterparties, economic sector, currency, geographic region, economic activity and reliance on raw materials.
    - Process to identify correlation between debtor solvency, guarantee/collateral and counterparties, and linkages/correlations between different risk types.
    - Process to identify risk factors covering on- and off-balance positions and revocable/irrevocable positions.
    - Measure, assess, control and monitor concentration by financing type, rating, economic sector, geographic area, debtor, borrower and counterparty.
    - Establish information systems for periodic and timely reports on total risk of debtors/borrowers/connected counterparties denoting a "common risk", and on concentration by geographic region, economic sector, market segment and funding sources.
  - Article 53 CUB allows certain risks among connected parties to be excluded from aggregation to determine lending limits when repayment sources of a principal party are not dependent on those of a connected party; exclusions are at institution’s discretion without further CNBV guidance or notification requirements.
  - Article 56 excludes exposures to Government of Mexico, Banxico, and IPAB, as well as loans to sub-national governments in compliance with eligible conditions.
  - Article 52 requires institutions to adopt procedures for implementing risk aggregation requirements, which must be approved by CNBV.
  - Regulation on risk concentration is currently under revision to align with Basel standard for Large Exposures.

### EC2 — Information systems to identify and aggregate concentrations and large exposures
- Description and findings:
  - Article 54 CUB establishes maximum permissible financing limits to a single counterparty or group of connected counterparties varying according to capital adequacy:
    - Capital ratio
      - Bigger than 8% up to 9% — 12
      - Bigger than 9% up to 10% — 15
      - Bigger than 10% up to12% — 25
      - Bigger than 12% up to 15% — 30
      - Above 15% — 40
  - Article 54 CUB mandates the three largest exposures of a bank cannot exceed 100 percent of its Tier Capital 1.
  - Current regulations do not provide an explicit definition of large exposures at the generally accepted 10 percent level, and there is no maximum aggregated lending limit for all large exposures. Article 58 of the CUB requires institutions to track and report exposures that equal or exceed 10 percent of basic capital.
  - Article 57 mandates use of the same credit conversion factors applicable for calculating credit capital charges for off-balance sheet exposures to calculate equivalent risks for credit concentration purposes.
  - Limits are not applicable on a fully consolidated basis up to the highest level of the regulated parent in Mexico (the financial holding company regulated by SHCP).
  - CNBV monitors banks’ mechanisms to ensure activities can be carried out with risk levels consistent with Tier 1, liquid assets and operating capacity across normal, adverse and extreme conditions.
  - Banks must have automated systems for periodic and timely reports showing concentration by geographic region, sector or market segment and must disclose publicly the number and amount of financing that exceed 10 percent of basic capital, and the maximum amount of financing with the debtors that represent greater risk.
  - CNBV monitors quality and timeliness of concentration and large exposure information via regulatory reports, verifies quality in inspection visits and internal audit reviews; internal audit must verify IT infrastructure integrity, confidentiality and availability.

### EC3 — Risk appetite thresholds and Board reporting
- Description and findings:
  - Article 80 CUB directs institutions to adopt risk limits at least as stringent as those in the CUB, including concentration by credit facility type, economic sector, geographic location, and single and group exposures.
  - Systems and risk limits are reviewed and monitored by the risk management unit (Article 74 CUB), internal audit unit (Article 76 CUB), and a bank compliance officer (Article 143 CUB); these control functions report to audit and risk committees, which inform the Board at frequencies from monthly to annual.
  - Article 15 III c) CUB requires sensitivity testing of projected cash flow of credit exposures to variation of risk factors for credits with maturities exceeding 12 months.
  - On-site inspections review reports from audit and risk management units and relevant committees to confirm Board is well informed.

### EC4 — Supervisor’s regular information on portfolio concentrations
- Description and findings:
  - CNBV receives monthly a comprehensive inventory of all banks’ credit portfolio exposures (Articles 207 and 208 CUB), enabling monitoring of sectoral, geographical and currency concentrations.
  - Monthly CNBV prepares and publishes a uniform report with concentration measures per required dimensions, including credit risk concentration of the system’s 25 biggest debtors and each bank’s biggest debtors, and the impact in the CAR of the default of the 5 biggest.
  - Article 61 CUB requires institutions to report excesses over exposure limits to CNBV, including a remediation plan subject to Commission approval; CNBV can require remedial action under this Article.
  - Article 59 CUB empowers CNBV to impose more stringent risk exposure limits than those in Article 54 based on assessment of deficiencies in risk management and control systems.
  - CNBV measures include economic penalties for breaches of maximum lending limits, and requirements to strengthen IT systems and concentration risk procedures.

### EC5 — Definition and supervisory discretion on groups of connected counterparties
- Description and findings:
  - Definition of credit exposure to individual counterparties or groups of connected counterparties is established by the LIC and not delegated to the supervisor.
  - Articles 1 and 52 CUB define three relationship types for presuming a common risk unless proven otherwise:
    - (i) persons acting in concert due to specific family relationships;
    - (ii) persons not having control but being able to exert management power upon a company;
    - (iii) persons exerting control by being able to impose decisions on the general assembly or to nominate the majority of the Board of a company.
  - "Acting in concert" criterion is restricted to parties connected by family relationships; no explicit regulatory guidance on implementation.
  - CNBV lacks explicit powers to exercise discretion regarding exposures among parties not connected under Article 52 links.
  - CUB does not provide explicit criterion to aggregate exposures of economically interdependent parties as a single common risk when the problems of one could significantly affect others’ repayment capacity.

### EC6 — Prudent requirements for large credit exposures and monitoring
- Description and findings:
  - Limits to a single counterparty discussed in EC2.
  - Limits can be surpassed up to 100 percent of Tier 1 capital for exposures secured with unconditional and irrevocable guarantees granted by foreign financial institutions with investment grade from OECD or European Union member states and exposures guaranteed by the Mexican government.
  - Article 57 CUB requires using capital framework conversion factors to off-balance sheet positions for credit concentration purposes.

### EC7 — Stress testing for significant risk concentrations
- (Description and findings truncated in source content; EC7 header present but no further text provided in the supplied excerpt.)

*Source: Annex 33 of the CUB, Accounting Standards B-6 "Loan Portfolio", paragraphs 9, 11 and 105 (excerpts).*

### Annex 12-B CUB requires that for stress testing purposes, banks consider the nature of

### Annex 12-B CUB requires that for stress testing purposes, banks consider the nature of

### Stress testing: exposures and concentration
- Banks must consider the nature of their exposures and their degrees of concentration during different scenarios, including adverse ones and by types of risk.
- Banks are required to consider at least:
  - the impact on the value of the same type of collateral due to conditions that could significantly affect the bank's ability to realize their expected value;
  - the deterioration in the credit quality or the value of collaterals in a certain economic sector, currency, geographical region, economic activity or reliance on the raw material in which the Institution is concentrated;
  - the abrupt deterioration of the credit quality of the main borrowers.

### Assessment of Principle 19
- Rating: Materially non-compliant
- Key comments:
  - Mexican regulation of large exposures sets different limits depending on the actual capital ratio of banks, departing from the Basel standard.
  - It lacks a formal definition of large exposure.
  - Framework for connected party lending does not empower CNBV to determine connected parties beyond links defined in the regulation (e.g., mutual economic interdependence).
  - CNBV could monitor exclusions allowed by Article 56 and require banks to tag, track, and notify them.
  - A regulation on large exposures under preparation (implementation delayed due to COVID-19) will align Mexican rules with the Basel standard and likely achieve compliance with this CP.
- Note: “Such requirements should, at least for internationally active banks, reflect the applicable Basel standards. As of September 2012, a new Basel standard on large exposures is still under consideration.”

### Principle 20 — Transactions with related parties: summary and essential criteria findings
- Principle objective: prevent abuses and conflicts of interest in transactions with related parties; require arm’s length terms, monitoring, mitigation, and write-off policies.

EC1 — Definition of “related parties”
- Article 73 LIC defines related party as:
  - (i) individuals or entities who directly or indirectly control two percent or more of the capital stock of the institution, the holding company or the other institutions of the financial group;
  - (ii) members of the board of directors of the bank, the holding company, or other companies of the financial group;
  - (iii) spouses and life partners of the above;
  - (iv) any person, other the CEO and the managers directly reporting to the CEO who may bind the institution with their signature;
  - (v) firms and their directors and officers, in which the bank or the holding company directly or indirectly, control ten percent or more of the capital stock;
  - (vi) legal entities in which the bank’s officers are directors or managers;
  - (vii) legal entities in which any of the entities mentioned above have direct or indirect control of ten percent or more of the capital stock or in which they have decision-making powers;
  - (viii) any operation through an unrelated third party or a trust, where the counterpart funds depend on any of the parties previously listed.
- Article 1, CXXXVII CUB defines “relevant related party” as natural or legal persons who control 20 percent or more of the capital stock of the bank; shares of such persons are added to shares owned by relatives and trusts whose cash flow for repayment depend on relevant parties and their relatives.
- Scope limitations and issues:
  - CUB definition of control (Article 52 III) requires power to impose decisions at the general assembly or to nominate/replace majority of the Board; companies with control ≤50 percent (e.g., associates under IAS 38) may be excluded from aggregation.
  - CNBV lacks explicit powers to (i) exert discretion to determine related parties beyond formal definitions, or (ii) expand the scope of related party transactions for aggregated risk exposures, though in practice CNBV has exercised discretion.

EC2 — Arm’s length terms
- Article 73 VII LIC requires operations with related parties be on terms no more favorable than similar operations with the general public.
- Banks intending to assign rights or debts exceeding 25 percent of Tier 1 capital to persons with relevant links must request authorization from Banxico, including analysis of transfer price (Circular 15-2012 of Banxico).

EC3 — Board approval and conflict exclusion
- Article 73 LIC requires approval of related party transactions by at least three-fourths of the directors present; minimum quorum is half plus one (Article 22 XI LIC).
- Article 73 requires directors and officers to be absent and abstain from voting where they have a direct interest.
- Article 73 Bis requires all operations with related parties to be submitted to the Board for approval.

EC4 — Process safeguards and internal controls
- Article 73 requires approval by 3/4 of the Board; proposal sent with favorable opinion of the Risk Committee.
- Transactions up to UDI2 million (US$280,000) are notified to the Board with supporting information.
- CUB mandates banks to have a credit manual describing policies, procedures and methodologies for credit risk origination and management.
- CNBV may suspend bonus payments to CEO, managers two levels below CEO, and staff directly involved in related-party operations if bank is subject to corrective measures.

EC5 — Limits, capital deductions, collateralization
- Standard related parties are subject to the same general lending limits as “connected parties,” on a scale from 12 to 40 percent of the bank’s Tier 1 capital for each standard related party after aggregation with connected persons.
- Aggregated limit for standard related parties (Article 73 Bis LIC): 35 percent of Tier 1 maximum lending limit as a whole set of parties related to an institution.
  - Collateralized exposures with related parties are not subject to this aggregated limit.
  - Reducing this aggregated limit would require amendment of the LIC.
- Banks must deduct from Tier 1 capital aggregated risk exposures with relevant related parties which exceed 25 percent of adjusted Tier 1 capital (adjusted for mandated capital deductions).
  - Exposures with associated and joint venture companies related to a relevant related party are excluded from this deduction.
  - Loans to entities controlled by a director or senior officer, or where such parties may exert significant influence, are outside the scope of this deduction.
  - Except for this deduction, other instances of exceeding related-party lending limits are not mandated to be deducted from capital under the LIC.
- Limits do not apply on a full consolidated basis up to the highest regulated parent company in Mexico and differ for other nonbank financial intermediaries.
- CNBV may, during on-site inspections, instruct correction, modify required reserves, impose capital requirements or settlement if a related-party operation was granted in non-market conditions (article 38 and 39 Bis of the CUB).

EC6 — Identification, monitoring, reporting, independent review
- Article 80 I a) 2 CUB requires institutions to operate with policies and procedures for parties who present a “common risk.”
- Explicit provisions require specific policies and procedures to govern lending activities with related parties.
- CNBV verifies compliance via on-site inspections and offsite procedures (including review of Board minutes and credit committees).
- CNBV confirms monitoring and reporting through onsite inspections and offsite reviews.

EC7 — Supervisor information and reports
- CNBV obtains information via regulatory reports:
  - "R04C" series: information on commercial credits with ability to identify common risk operations.
  - R24 C-2431 "Information on operations with related parties": disaggregated information on operations that result or may result as debtors of banks.
- Banks submit this information monthly; monitored by line supervisors.
- CNBV reviews derivatives, securities, and interbank transactions submitted to Banxico, including between a Mexican bank and its foreign parent.
- Institutional Supervision Portal (PIN) procedures require identification and quantification of financing granted to validate full scope and limits.

### Assessment of Principle 20
- Rating: Largely compliant
- Comments and required actions for full compliance:
  - Amend Article 73 of the LIC to reduce the 35 percent of capital aggregated maximum limit with standard ‘related parties’ to a level consistent with international practice.
  - Reinforce CNBV powers by providing explicit powers to exert discretion on a case-by-case basis.
  - Amend the LAF to require observance of lending limits on a full consolidated basis at the holding company level and extend requirements to unregulated mixed activity holdings (EC5).

### Principle 21 — Country and transfer risks: summary and essential criteria findings
EC1 — Policies and processes
- CNBV believes country risk and transfer risk are not significant for Mexican institutions (example: war in Ukraine analysis).
- Article 114 of the CUB requires analysis of country risk for single borrowers with exposures above UDI 4 million (USD1.4 million equivalent).
- Annexes 20 and 21 of the CUB mandate use of sovereign ratings of three international rating agencies to map borrower country risk to nine categories used by CNBV for loan classification and provisioning.
- Transfer risk is not yet explicitly treated in CNBV regulations.
- CNBV obtains monthly information on risk exposures to non-resident borrowers/counterparties via prudential reports (R04).

EC2 — Board oversight and integration
- Current prudential regulation does not specifically mandate separate strategy, policies and processes for management of country and transfer risks.

EC3 — Information systems and reporting
- No specific CNBV requirements on how information, risk management and control systems should identify and report country and transfer risk.
- In practice, CNBV requires institutions to report all credit exposures with nonresidents with a specified country code.
- CNBV confirms tagging accuracy during on-site inspections and via internal audit.

EC4 — Supervisory oversight of provisioning
- IFRS 9 methodology considers country risk as part of credit analysis for individual debtors with exposures greater than UDI 4 million (annex 22 CUB).
- Probability of default measurement includes a quantitative variable for country risk based on evolution of gross GDP over the last 18 months.

EC5 — Stress testing inclusion
- For capital adequacy evaluation, CNBV provides macroeconomic scenarios (expected and adverse) including interest rates from other countries.
- Minimum points banks must include to consider transfer and country risks in stress tests:
  - Significant reductions in the market price and liquidity of assets,
  - Adverse movements in currency prices, whose impact affects its financial position,
  - Reduced availability of contingent credit lines,
  - Increased market volatility affecting quality of guarantees and derivatives valuation, implying increased position of guarantees or other liquidity needs,
  - Affectation of cash flow from breach of obligations by counterparties, correspondents or custodians,
  - Losses in value due to forced liquidation of assets necessary to meet liabilities or uncovered short-term positions.

EC6 — Supervisory information access
- No dedicated prudential report for country and transfer risks.
- In practice, institutions report credit exposures with nonresidents with a country code, which acts as a proxy for country risk.
- CNBV has specifically tagged only the largest known local corporate entities whose parent is located in Spain; similar procedure not followed consistently for other countries.
- CNBV’s economic analysis unit periodically distributes economic monitoring including country risk.

### Assessment of Principle 21
- Rating: Largely compliant
- Key observations:
  - Country risk considered non-material in Mexico; main banks belong to global groups without material cross-border activities from Mexico.
  - Regulatory reports allow CNBV to determine banks’ country risk exposures and take supervisory action when necessary.
  - Recent CNBV review: country and transfer risks were not material, measured at 1.9 percent, including exposures to USA bonds, as of December 2021.
- Recommended supervisory enhancements:
  - Require institutions whose parents are located in the EU and NAFTA countries to undertake ad-hoc periodic reporting of country and transfer risks based on management information systems used to report to parents.
  - Require other institutions to review codification of prudential reports to ensure appropriate tagging of end-borrower/end-counterparty (not only nonresident borrower) for both types of exposure by country.
  - Consider publication of guidance on expected risk management practices after compiling practices observed in leading local institutions.

*Annex 12-B CUB requires that for stress testing purposes, banks consider the nature of — Source: IMF mission document excerpt.*

### Chapter IV CUB), which includes the responsibilities of the Board of Directors and senior

### Chapter IV CUB)

### Regulatory framework and institutional responsibilities
- Articles 66 to 78 CUB: require written risk governance framework detailing responsibilities of the Board of Directors and senior management; definition of risk profile and risk appetite for each relevant risk, including market risk; internal policies and committees (roles, decision making and reporting); functions and characteristics of the comprehensive risk management unit (UAIR); policies and procedures to identify, measure, monitor, report and mitigate risks; establishment, control and notification of limits and rules to follow when these limits are exceeded.
- Article 82 CUB: establishes specific minimum requirements for capital markets and trading activities generating market risk, including the use of models, valuation of positions and instruments, validation of models and concentration of market risk; extends to data collection, back testing, stress testing, and comparison of actual vs. projected results and risk measures.
- Macroeconomic conditions are considered explicitly in yearly stress testing exercises required by CNBV.

### Market risk management requirements for the trading book
- Analyze, assess and monitor all positions subject to market risk by means of VaR models that measure the potential loss in the trading book, associated with movements in prices, interest rates or exchange rates, with a given level of probability over a specified period.
- Seek consistency between valuation models for positions in financial instruments, including derivatives, used by the unit for comprehensive risk management and those applied by the business units.
- Assess concentration of positions exposed to market risk.
- Compare the estimated market risk exposures with the results actually observed; when they differ significantly, corrections must be made.
- Maintain the historical information of the Risk Factors necessary for the calculation of the market risk.
- Calculate potential losses under different scenarios, including extreme scenarios (Annex 12-B CUB, on Stress test requisites).

### Supervisory activities and practices (CNBV)
- CNBV determines periodically the suitability of market risk management processes and applicable policies by:
  - (i) evaluation of the annual reports of the comprehensive risk management and internal audit units; and
  - (ii) risk focused and annual on-site reviews of institutions’ activities.
- Annual reports from internal auditors are reviewed off-site; CNBV may request ad-hoc internal audit work to provide specific opinions (‘certifications’) on particular issues.
- Inspection frequency and scope:
  - Decision each year by the Supervisory Group of CNBV, following the level of risk assessed via the risk matrix (CEFER).
  - Normal practice: on-site inspection covering market risk every two years.
  - For large institutions, nearly every year there is a target review in the area of market risk.
- On-site transaction testing performed to:
  - (i) verify positions and transactions in financial instruments, with a focus on valuation, data entry and the calculation of and compliance with trading and market risk limits; and
  - (ii) assess the effectiveness and reliability of management and control systems.
- On-site reviews performed by line inspectors and, if requested, by risk specialists; market risk models and risk measurement techniques normally reviewed by risk specialists.
- CNBV initiates formal or informal actions to remedy deficiencies and follows up via off-site and on-site work.
- There are no standards for market risk management for regulated holding companies similar to those required of banks acting as parents in a banking group.

### EC2 — Board oversight and approval of market risk strategies (Description and findings)
- Article 68 CUB: boards or risk committees are responsible for approving the risk appetite; the framework for comprehensive risk management; limits for each risk; risk tolerance; corrective actions; contingency plan and financing contingency plan.
- Senior management is responsible for implementation of the bank's risk strategy and capital adequacy to cover exposures above minimum regulatory requirements.
- Supervisors verify consistency of internal policies/processes with bank objectives and strategic plans by reviewing regulatory reports, committee minutes, and accompanying documentation.
- Supervisors check that boards:
  - are effectively involved in design, implementation and execution of the comprehensive risk management framework (including market risk); and
  - review risk exposure limits at least once a year and work closely with senior management and the risk committee.

### EC3 — Market risk environment, information systems, limits and reporting (Description and findings)
- Article 78 CUB: general requirements for risk management activities including organization, roles and responsibilities of board, management, risk committee and UAIR; assessment, monitoring, control and reporting of limits and limit breaches.
- Article 82 CUB: specific minimum requirements for capital market and trading activities (models, valuation, model validation, market risk concentration, data gathering, back-testing, stress testing, comparing actual vs. projected results and risk measures).
- Reporting and data access:
  - Institutions inform CNBV of their market risk and capital market activities via prudential reports.
  - CNBV has access to Banxico’s information system warehouse permitting a full inventory of all financial instruments, including off-balance sheet contracts and OTC derivatives, integrating different portfolios (trading, available for sale, and held-to-maturity).
  - For large or higher-risk institutions, supervisors require more frequent (weekly) reports and granular analysis in excel format.
  - Information is used to elaborate analytical reports and indicators for weekly and monthly analysis.
- Standardized monthly market risk report (prepared by the technical vice-presidency) provides indicators including:
  - A summary reconciliation of portfolios-at  -risk to balance sheet and marked-to-market values.
  - Relative positions in fixed income, derivatives, equity, and foreign exchange portfolios.
  - Long, short and net positions by risk factor (interest rate by currency, equity, and FX rate).
  - VaR by the same risk factors at the 99 percent level (1 and 10 days), and expected shortfall.
  - Potential loss under stress: (a) 99 percent,1 day VaR and split VaR; and (b) VaR per market (99 percent, 1 day and 10 day).
  - Composition of the trading portfolio (gross and net) by market (cash, derivatives, currency and equity) and major instrument type.
  - Capital adequacy ratio estimated under stressed VaR (above) and past scenarios.
- CNBV uses these standardized metrics for supervisory follow-up and may require modification of market risk limits, specific capital charges and exposure limits for institutions with deficiencies.
- During inspections, CNBV reviews:
  - Effective information systems for accurate and timely identification and measurement of risks; UAIR must report daily to CEO, head of internal audit, and heads of relevant business units; during high volatility, information may be distributed intraday.
  - Market risk limits (Articles 69, 74 and 75 CUB) consistency with risk appetite, profile, capital strength and management’s ability to manage market risk; Article 71 CUB requires personnel involved in risk-taking decisions to know the bank's risk limits, risk profile, risk tolerance, and capital strength.
  - Immediate reporting by UAIR to the risk committee on deviations from defined risk appetite, limits or tolerance (Articles 69, 70 and 74); CEO responsible for corrective action plans.
  - Risk committees must approve all risk assessment models, including market risk models, proposed by UAIR (Article 71 CUB); Article 75 CUB requires UAIR to ensure correct measurement, monitoring and control of various risks including market risk.

### EC4 — Valuation practices and controls (Description and findings)
- Valuation requirements:
  - Accounting criteria for valuation of financial instruments set out in Article 174 CUB and compiled in Annex 33; criteria include rules to adjust values, make provisions, establish investment loss reserves, and value less liquid securities including provisions for marking-to-model.
  - Article 175 Bis 6 CUB: banks must daily mark to market all positions using information and market prices provided by price providers authorized by CNBV.
  - Banks must carry out, at least once a month, a verification of the accuracy of these prices through a valuation carried out by a unit independent from the business units.
  - Reviews on timeliness and completeness of valuations are made through on-site inspections.
- CNBV evaluates adequacy and reliability of systems and controls by monitoring annual work programs and reports of risk management and internal audit units, target reviews per supervision manual, and biannual reports of technical evaluation of risks (Article 77 CUB).
- Banks are required to remedy deficiencies; follow-up by on-site target visits and off-site work, including ad-hoc reports from internal audit or risk management unit.
- Internal valuation models:
  - Permitted if compliant with articles 175 Bis 3 and 175 Bis 8 CUB.
  - Internal models must be reviewed and validated by a unit independent of the business units that take risks, which could be internal audit.
  - Banks must have appropriate policies and processes to use internal valuation models.
  - Internal valuation models must include adjustments considering, at least, the costs of cancellation and closing of positions, operational risks, the financing costs of the operations, future administrative expenses, unrecognized credit spreads, model risk (including that associated with the use of an incorrect valuation methodology and with the calibration of unobservable parameters), and the illiquidity of positions.
- Institutional Supervision Portal valuation criteria for on-site inspections:
  - Money market portfolios: verify valuation recorded in accordance with regulation, using prices from authorized price providers; accounting guidelines, policies and procedures.
  - Capital markets: verify initial accounting record, transfers between accounts, sales, maturity of investments in securities, profit recognition due to valuation (increase/decrease), interest and sale of these investments.
  - Derivative operations: verify valuation models of derivative products, risk measures, internal controls, security and integrity of information systems, data processing, risk management and models valuation.

### EC5 — Capital adequacy and valuation adjustments (Description and findings)
- Article 2 Bis 2 CUB: banks may use internal valuation models provided that positions valued according to models are adjusted for capital requirement purposes by including, at least, the costs of cancellation and closure of positions, operational risks, transaction financing costs, future administration expenses, unrecognized spreads, model risk (including the risk associated with the use of an incorrect valuation methodology, and the calibration of unobservable parameters), and, where appropriate, the lack of liquidity of the positions.
- Banks must establish and follow procedures to identify illiquid positions and continuously verify that corresponding adjustments remain valid, considering factors such as time needed to hedge the position, volatility of purchase and sale price differentials, availability of market prices, average and volatility of amounts traded under normal and stress conditions, market concentrations and time elapsed since transaction agreement.
- Annual capital adequacy assessment: banks must assess whether their capital is sufficient to cover possible losses from market risk exposures in different scenarios defined by supervisors. If assessment shows insufficient capital, the bank must submit a capitalization plan, which CNBV may challenge and require more capital.

### EC6 — Stress testing
- The supervisor requires banks to include market risk exposure into their stress testing programs for risk management purposes.

*Italic: Source — 1mexea2023002 - Chapter IV CUB) (PDF).*

### Annex 12-B CUB, details the general and risk specific requirements for stress tests,

### Annex 12-B CUB, details the general and risk specific requirements for stress tests

### Stress testing requirements and scope
- Stress tests must be carried out at least once a year as a comprehensive risk management tool.
- Banks must contemplate short and long term specific and systemic scenarios, as well as combined scenarios, and their impact on the structure and financial profits of the bank, without ruling out scenarios of low-probability high-impact.
- The design of the scenarios must observe the type of operations and exposures to which the Institution is subject, reflecting its degree of complexity and in accordance with the guidelines defined by boards, considering most recent stress events and events with the greatest volatility that the Institution may face.
- For market risk, banks must consider the following assumptions to define their scenarios:
  - (i) illiquidity events and price increase;
  - (ii) concentration of positions relative to the total placement amount;
  - (iii) markets with only buying or selling positions;
  - (iv) existence of non-linear products and options out of the money;
  - (v) significant changes in correlations; and
  - (vi) any other risk that is not adequately captured by VaR methodologies.
- Article 71 of the CUB establishes the obligation of the approval, monitoring and participation of the Board of Directors in the generation of such stress testing exercises.

### Market risk — aggregate figures and impacts
- Market risk risk-weighted assets, in December 2021, amounted to MXN1.57 trillion (USD78.5 billion equivalent), or 20 percent of total RWAs, including both trading and banking books.
- As of October 2021, the system foreign exposures totaled USD20 billion (short) and USD20.5 billion (large); thus, the net open position (large) _to USD409 million, which would produce a 63 basic point reduction of capital if the MXN experienced a 25 percent depreciation against the USD.
- The net short position in the trading book MXN 33 billion together with the net short position in interest rate swaps, would produce a 44 basic point reduction in capital to the 250 basic point increase in the interest rate curve.
- Banxico’s restrictive regulations for foreign currency open exposures, together with the current level of sophistication of the Mexican capital market, determine that the risks associated with trading activities of Mexican banks are quite limited.

### Supervisory assessment and recommendations (Principle 22)
- Assessment: Principle 22 — Compliant.
- Supervisory review concludes compliance with essential criteria is fully achieved, with potential enhancements:
  - Use the concentration metrics already calculated as ‘entry note’ to rate the risk profile of institutions explicitly under the current risk rating methodology (EC2), also see CEFER in CP19.
  - Compile and publish observed risk practices among different types of institutions in managing market risk inherent in their trading and capital market activities.
  - Amend the LAF to require consistent market risk management standards at the group level, including local holding companies and significant nonbanking institutions within a group.

### Interest rate risk in the banking book (IRRBB) — legal and supervisory framework (Principle 23)
- Assessment: Principle 23 — Compliant.
- EC1 — Legal/regulatory requirements and framework:
  - IRRBB is regulated by Article 83 of the CUB, which mandates banks to analyze, assess, and monitor the impact in financial income and economic value using risk models that measure potential loss in the banking book associated with exchange rates and interest rates by currency, over a specific period.
  - Valuation models must be consistent with models used by business units; banks must compare projected variations in financial income with actual observations and calibrate the model as warranted.
  - To estimate potential losses, different scenarios, including extreme scenarios, must be used. Historical information of risk factors used for the calculation must be kept.
  - Article 67 requires banks to define objectives on risk exposure and develop policies and procedures to identify, measure, monitor, limit, control, report and disclose risks.
  - Article 68 assigns the Board responsibility to approve risk appetite, risk tolerance levels, corrective mechanisms, and contingency plans; Boards shall review at least once a year the adequacy of risk exposure limits for each type of risk.
  - Article 74 requires daily provision of market risk exposure information to the General Director, head of internal audit, and heads of business units, and, in high volatility situations, potentially on an intra-day basis.
  - Article 75 establishes minimum conditions for measurement, monitoring and control of risks including consolidated exposure, impact on capital and income statement, and risk concentrations.
  - Article 88 requires banks to disclose a brief description of methodology for identifying, quantifying, managing, and controlling market risk, including IRRBB.
  - Title One of the CUB regulates capital charges for market risk in accordance with Basel III recommendations; Mexican rules include the IRRBB in Pillar 1 requirements.

- EC2 — Board approval, review, and senior management implementation:
  - Strategies, policies and processes for IRRBB management are approved and reviewed by the Board; Article 68 requires Boards to review adequacy at least once a year.
  - Supervisory activities include assessment of periodic regulatory reports and annual risk management/internal audit reports; offsite evaluation of sensitivity to changes in interest rates; and targeted onsite reviews.
  - Reports submitted to Banxico are available to CNBV which prepares analytical reports and calculates monitoring and analysis indicators.
  - Supervisory focus is on largest banks (G-7) which have more elaborate information systems.
  - The Directorate of Methodology and Risk analysis of the Technical Vice Presidency, staffed with 26 specialists in modelling and risk measurement, assesses adequacy of IRRBB practices and assists line supervisors.

- EC3 — Measurement systems, validation, limits, exceptions, and information systems:
  - PIN guides supervisors to assess risk management practices, including:
    - Assess methodologies and systems used to evaluate behavior of different risks.
    - Assess methodologies, models, parameters, scenarios and assumptions used to measure risks.
    - Verify UAIR performs measuring, verifying, and analyzing adequacy of capital and liquidity levels.
    - Verify UAIR monitors compliance with internal policies and regulatory limits.
    - Verify identification of potential events and changes in economic conditions affecting the bank.
    - Assess sensitivity analysis and stress testing under different scenarios.
    - Assess internal audit role regarding risk controls and compliance.
  - CNBV examines structural re-pricing mismatches among interest-earning assets and interest-bearing liabilities and considers these adequately covered by charging the banking book with market risk capital requirements.
  - On-site reviews indicate most sources of interest rate risk in the banking industry are located in the “held to maturity” portfolio of securities, since most loan portfolios are short or medium term and long-term portfolios are mostly contracted at variable interest rates.

- EC4 — Stress testing scenarios for IRRBB:
  - The supervisor requires banks to include appropriate scenarios into their stress testing programs to measure vulnerability to loss under adverse interest rate movements.
  - As part of the ICAAP banks should estimate impact under baseline and adverse scenarios; baseline uses expected macroeconomic assumptions including interest rates.
  - CNBV determines scenarios using its own projections and those of Banxico, SHCP and private sector experts.
  - For adverse scenarios CNBV considers a set of unfavorable projections and risk variables to evaluate financial strength under adverse but possible situations.
  - Annex 12-B of the CUB requires banks to conduct stress tests that consider interest rate risk at least once a year to estimate potential effects on income and economic value.
  - CNBV periodically conducts interest rate sensitivity analysis under different scenarios on a case-by-case basis, projecting cash flows and financial statements on a monthly basis for a two-year horizon.
  - CNBV simulates scenarios with changes in the peso exchange rate, inflation, GDP growth, and interest rate changes, including estimated changes in banks’ deposits which impact the net interest margin and the CAR.
  - CNBV simulation model estimates impact on financial performance and economic value to parallel shifts in the yield curve and changes in key rates; monthly sensitivity and stress testing of the above measures are conducted.

### Practical observations and supervisory focus
- In practice, management of IRRBB is more sophisticated in large than in small banks; supervisors focus on the largest banks (G-7).
- Smaller banks are required to conduct standard market risk stress scenarios periodically; this is being extended to their banking books and captures all interest earning assets and interest-bearing liabilities, including loans and deposits.
- Although regulations do not differentiate between banking and trading books for capital purposes (Pillar 1), banks are required to manage both books separately and supervisors assess management of banking and trading books separately.

*Source: Annex 12-B and associated sections on market risk and IRRBB contained in the provided content.*

### conclusion that compliance with the essential criteria of this CP is adequately achieved.

### conclusion that compliance with the essential criteria of this CP is adequately achieved.

### Principle 24 — Liquidity risk
- Framework and requirements
  - Liquidity requirements established in joint regulations between CNBV and Banxico; aligned with BCBS standards.
  - All commercial banks, both internationally active and local banks, must comply with the LCR and the NSFR.
  - Final rule on the LCR and NSFR published in August 2021 and entered into force in March 2022.
  - LCR recognized in the Basel Committee consistency assessment (RCAP, 2015).
  - NSFR information requested from institutions since 2017 and monitored by CNBV and Banxico.
- EC1 (prescribed liquidity requirements)
  - Regulatory provisions include calculation of the LCR, regulatory minimums, thresholds triggering supervisory actions or liquidity scenarios, corrective measures and plans, definitions of breaches, and disclosure guidelines.
  - At least for internationally active banks, LCR and NSFR are not lower than applicable Basel standards.
- EC2 (requirements reflect banks’ liquidity risk profile)
  - Minimum quantitative liquidity requirements fully based on Basel standards via the LCR and NSFR; consider market conditions and on-balance and off-balance sheet positions.
  - CUB (Article 81 and Annex 12-B) mandates banks to conduct stress testing including liquidity adequacy; design shared with CNBV.
  - CUB requires documented contingency funding plans per Annex 12-C.
  - Monthly CNBV individual and system risk analysis includes LCR (daily average, median and minimum), liability concentration, NSFR evolution and volatility, interbank financing concentration, and level of debt funding.
- EC3 (robust liquidity management framework)
  - Article 81 CUB sets principles for liquidity risk management: consider bank risk profile, restricted market access, interactions with other risks, forecasts of inflows/outflows, funding concentration, mismatch forecasts, and types/value of available collateral.
  - Compliance assessed during on-site examinations and included in CEFER methodology.
  - CNBV assesses documentation, information systems, policies, procedures, and proper calculation of prudential liquidity ratios (CCL, CFEN).
- EC4 (liquidity strategy, policies, processes)
  - Article 65 and related Articles (68, 69, 70, 71, 74) of the CUB require: mechanisms to keep operations within risk levels, Board approval of Desired Risk Profile and Comprehensive Risk Management Framework, Contingency Funding Plan, Board oversight and at least annual review of liquidity and capital adequacy, Risk Committee reporting at least quarterly.
  - Article 69 requires CEO to ensure data systems and procedures for timely and quality information flows to UAIR.
  - CNBV verifies suitability through offsite monitoring (daily/monthly indicators), review of risk unit reports (weekly or more frequent), and on-site reviews; can initiate formal or informal actions.
- EC5 (funding strategies and monitoring)
  - CUB (articles 67, 74, 80, 81, 82 and 83) requires diversification of financing sources by maturity and potential losses.
  - Article 81 mandates adequate level of liquid assets covering outflows even in stress, considering desired risk profile and asset realization value.
  - Liquidity stress tests to consider buyback needs and non-contractual obligations to mitigate reputational risk.
- EC6 (contingency funding plans)
  - Article 81 requires a Contingency Funding Plan (PFC) per Annex 12-C: identify activation authority and notification process; decision-making instances; coordinating instances with sufficient hierarchy; events and indicators activating PFC; criteria to assess severity.
  - CNBV may require amendments to PFC.
- EC7 (stress testing program)
  - Article 81 and Annex 12-B require documented stress tests approved by the bank’s risk committee, at least annual verification, institution-specific and systemic scenarios (short- and long-term), multiple severity degrees including extreme scenarios.
  - Banks must submit stress test designs to CNBV which can order modifications; results and their incorporation into the PFC are subject to CNBV review and approval.
  - CNBV reviews include realism of scenarios, asset price movements and liquidity, and correlations among market financing sources.
- EC8 (foreign currency liquidity)
  - Total liabilities in foreign currencies limited to 1.83 percent of capital (Circular 3/2012 of the Central Bank).
  - Banxico carries out daily surveillance of foreign currency exposure of credit institutions.
  - Article 81 requires liquidity analysis by currency type; stress tests must consider adverse currency price movements.
- Assessment of Principle 24
  - Largely Compliant
  - Comments: Well-established regulatory and supervisory framework; inclusion of LCR and NSFR fully aligns framework with Basel III. Shortcoming: deposit-taking development banks not subject to current liquidity prudential framework applicable to commercial banks — recommendation to require development banks to adhere to prudential regulation addressing liquidity risk.

*1mexea2023002 - conclusion that compliance with the essential criteria of this CP is adequately achieved.*

### Principle 25 — Operational risk
- Overall
  - Supervisor determines banks have operational risk management consistent with risk appetite, profile, and macroeconomic conditions.
  - Operational risk defined as risk of loss from inadequate or failed internal processes, people and systems or external events (includes legal risk, excludes strategic and reputational risk).
  - CNBV created specialized supervisory area DGSROT; compliance assessed via CEFER matrix.
- EC1 (laws/regulations require OR management)
  - Title II, chapter IV of the CUB requires comprehensive risk management processes covering operational, technological and legal risks; Board approval of risk exposure limits.
  - Article 86 CUB requires banks to identify operational risks and establish minimum measurement and monitoring practices; UAIR must be independent.
- EC2 (Board approval and oversight)
  - Article 68 CUB places responsibility on the Board to approve desired risk profile, framework, exposure limits and tolerance levels.
  - Risk Committee (Article 70) must include at least two Board members, general manager, head of UAIR; meets at least monthly.
  - Specific operational risk policies per Article 86 include inventories of risks, quarterly reporting, risk tolerance levels, loss event database, operational risk indicators, and information for decision-making.
- EC3 (implementation and integration)
  - CNBV onsite reviews verify assignment of responsibilities, Board-approved policies, and adherence by management.
- EC4 (disaster recovery and business continuity)
  - Regulation requires Disaster Recovery Plan (DRP) and Business Continuity Plan (BCP) with detailed technical appendix.
  - CNBV verifies adequacy via on-site examinations; supervisory methodology includes tasks for IT supervisors.
  - DGSROT developed risk-based methodology aligned with COBIT, COSO, NIST, ITIL.
- EC5 (IT policies and infrastructure)
  - Banks obliged to assess vulnerability in hardware, software, systems, applications, security and networks; required to report significant IT modifications.
  - Article 168 bis 11–13 of the CUB require information security policies, technological infrastructure obligations, and appointment of a Chief Information Security Officer (CISO).
  - CNBV supervises technological infrastructure and focused in the last 3 years on CISO formalization and security master plans; cyber on-site inspections started in April 2022 but limited by resources.
  - CNBV’s cyber regulation currently applies to banks, brokerage houses, and financial technology institutions; some significant entities remain outside enforceable cyber regulation.
- EC6 (information systems for OR)
  - General requirement for information systems to manage and control risks; articles 68 and 69 define roles/responsibilities for Board, senior management and Risk Committee.
  - Article 86 SCI requires historical database of operational loss events; supervisors verify during on-site examinations.
- EC7 (reporting mechanisms)
  - Reporting template R28 ‘Operational Risk Information’ collects operational loss data by business line, process and product and inherent risk ratings.
- EC8 (outsourcing)
  - CUB Articles 317–318 permit outsourcing subject to requirements: access to provider records, confidentiality, restriction on onward outsourcing, board-approved report describing outsourced processes, provider selection criteria, inclusion in contingency plans, dispute resolution, Audit and Risk Control roles.
  - CNBV conducts routine on-site examinations to verify compliance.
- Assessment of Principle 25
  - Largely Compliant
  - Comments: Significant regulatory and supervisory improvements; specialized DGSROT created. Supervision of cybersecurity risks still developing and needs proper staffing to perform effective IT risk supervision.

*1mexea2023002 - conclusion that compliance with the essential criteria of this CP is adequately achieved.*

### Principle 26 — Internal control and audit
- EC1 (internal control frameworks)
  - Articles 141 and 142 of the CUB provide comprehensive regulation for internal controls and internal auditing; responsibilities across Board, senior management, audit committee, internal and external auditors.
  - Required internal control system to cover: management oversight and risk control culture; risk identification and measurement; control activities and segregation of duties; accounting, information and communication systems; monitoring activities.
  - Independent internal audit unit and Audit Committee required; CNBV reviews compliance during on-site visits and has instructed Boards to improve segregation and independence where needed.
- EC2 (balance of skills/resources)
  - CNBV inspectors assess resource distribution between back and front offices with attention to segregation of duties and communication (e.g., daily reconciliation).
- EC3 (compliance function)
  - Compliance officers for AML/CFT mandatory; CNBV issues certification for compliance officers.
  - Boards must establish Comité de Riesgo to assist senior management; committee composition and monthly meetings mandated (Articles 166–167).
  - CNBV evaluates effectiveness of the compliance function during on-site exams, focusing on audit plans, past findings, manuals and reporting quality.
- EC4 (internal audit independence and role)
  - Board responsible for oversight of internal control and audit; internal audit duties include analysis and evaluation of financial, accounting, operational activities via on-site and off-site reporting.
  - CNBV has methodology (MIS and Bitácora) to review controls and update the CEFER risk matrix.
- EC5 (internal audit resourcing and authority)
  - CNBV assesses internal audit via on-site/off-site supervision, review of audit reports, external audit working papers, and interviews.
  - Supervisory standards: IA independent of business areas; reports to Audit Committee; submits annual work plan to Audit Committee; documented procedures and corrective measure adoption; IA understands institution’s strategy, activities and risks.
- Assessment of Principle 26
  - Compliant
  - Comments: Suitable regulatory and supervisory framework promoting best practices for internal control and audit.

*1mexea2023002 - conclusion that compliance with the essential criteria of this CP is adequately achieved.*

### Principle 27 — Financial reporting and external audit
- EC1 (Board/management responsibility for financial statements)
  - Article 179 CUB: financial statements must be signed by CEO, CPA, Comptroller, Internal Auditor or equivalents and approved by the Board.
  - Boards are responsible for accuracy; banks must have adequate record-keeping systems.
  - Banks must observe accounting rules for banks issued by CNBV aligned with internationally accepted accounting standards.
- EC2 (external auditor opinion and standards)
  - Banks required to disclose audited financial statements, external auditor opinion, and management comments annually and updated quarterly (Articles 180 and 212 CUB).
  - External auditors must adhere to ISAs and national auditing standards (Article 14 CUAE).
  - Boards annually approve designation, substitution, hiring, and fee of external auditor; Audit Committee reviews auditor performance.
- EC3 (valuation practices and fair value)
  - Annex 33 and Article 175 Bis CUB: classification into trading, available for sale, held to maturity; fair value determined by price vendors.
  - Banks must maintain systems and controls to ensure prudent, reliable valuations; policies approved and reviewed by Audit Committee; models subject to CNBV approval and possible suspension.
- EC4 (supervisor power over audit scope)
  - CNBV cannot exercise discretion to set or extend scope of external audits; can require institutions and external auditors to provide additional information.
- EC5 (audit coverage)
  - CUB sets minimum elements for external audits: loan classification and provisioning, loan portfolios, liquid assets, investments, deposits, off-balance sheet items, foreign currency, revenues/expenses.
  - CNBV annually reviews audit reports and discusses shortcomings with audit firms and banks.
- EC6 (power to reject/rescind auditor)
  - Article 25 LIC empowers CNBV to order removal, suspension or disqualification of external auditors for violations or false reports; Article 43 empowers CNBV to request a new audit when not satisfied.
- EC7 (rotation)
  - CUAE Article 7 requires alternation of independent external auditors at least every five years.
- EC8 (periodic meetings with external auditors)
  - No formal provision for regular meetings; CNBV may summon external auditors per Article 423 CUAE and meets post-audit to discuss internal controls, breaches, material transactions.
- EC9 (auditor reporting to supervisor)
  - Article 40 CUAE requires auditors to report irregularities that could jeopardize stability, liquidity or solvency to Board Chair, Audit Committee and CNBV; such communication is not a breach of confidentiality.
- Assessment of Principle 27
  - Compliant
  - Comments: Legal framework and practices follow international best practices and meet BCP criteria.

*1mexea2023002 - conclusion that compliance with the essential criteria of this CP is adequately achieved.*

### Principle 28 — Disclosure and transparency
- EC1 (periodic public disclosures)
  - CNBV’s Regulatory Accounting Standards align with international practices; CUB Articles 176–186 set minimum disclosure requirements generally in line with BCBS standards.
- EC2 (scope and content of disclosures)
  - Disclosures must include qualitative and quantitative information on financial performance, position, risk management, risk exposures, related-party exposures, accounting policies, governance and remuneration; prepared annually and updated quarterly.
  - Required website disclosures: audited financial statements, auditor opinion, management analysis, Annex 1-O template on capital and leverage, Exhibit 1-O Bis leverage composition, and Annexes related to LCR and NSFR composition.
  - Mandatory disclosures on risk management environment per Article 88 CUB and remuneration per Article 168 Bis 3 CUB.
- EC3 (group structure disclosures)
  - Banking groups disclose material entities in group structure.
- EC4 (supervisor enforces disclosure standards)
  - CNBV assesses compliance during supervision; LIC and CUB provide enforcement powers. CNBV quarterly and annually reviews notes to financial statements and may request further information or instruct mandatory disclosures.
- EC5 (system-level publications)
  - CNBV maintains a detailed database and publishes aggregated and individual bank information monthly; quarterly publishes LCR and NSFR averages.
  - CNBV disseminates relevant events (license revocation, digital service interruptions, new entity incorporations) and joint communications with other authorities.
- Assessment of Principle 28
  - Compliant
  - Comments: CNBV disclosure requirements align with internationally accepted practices.

*1mexea2023002 - conclusion that compliance with the essential criteria of this CP is adequately achieved.*

### Principle 29 — Abuse of financial services (AML/CFT)
- EC1 (supervisor duties and powers)
  - SHCP is responsible for AML/CFT regime implementation; for banks the competent agency is CNBV.
  - CNBV’s duties and powers established in LFPIORPI, LIC, LCNBV, RICNBV, RSCNBV, and DCG applicable to Banks.
  - Article 16 LFPIORPI: CNBV to carry out supervision, verification and monitoring of AML/CFT obligations and can develop AML/CFT supervision guidelines and policies.
- EC2 (banks’ policies and processes)
  - AML law requires banks to adopt KYC, staff integrity and training, suspicious activity detection mechanisms, timely reporting to FIU, designated reporting officer, and internal audit verifying AML/CFT compliance.
  - CNBV Inspection Guidelines on AML/CFT issued in March 2018 (amended 2021) provide supervisory tools and enhanced procedures for PEPs, beneficial owners, and due diligence.
  - Provision 64th DCG: Compliance Manual obligation; Provision 37th DCG: obligation to report unusual operations to SHCP via CNBV; Provision 10th Ter DCG: allows suspension of identification to avoid alerting customers.
  - CNBV certification program (2014) for auditors, compliance officers and professionals.
  - Article 170 CUB requires Board-approved code of conduct submitted to CNBV.
- EC3 (reporting to supervisor material suspicious activities)
  - Provision 37 DCG: unusual operations reported within three business days; "24-hour" report required where well-founded suspicion exists.
  - Banks must implement mechanisms to identify clients on list of blocked persons (LPB).
- EC4 (supervisor shares information with FIU)
  - CNBV and FIU meet periodically; collaboration agreement provides FIU feedback reports to CNBV which feed supervisory programs; CNBV shares observations and recommendations following supervisory activities.
- EC5 (CDD policies and processes)
  - Article 115 LIC and DCG set requirements for customer identification; (description of EC5 in source cuts off at this point).

*1mexea2023002 - conclusion that compliance with the essential criteria of this CP is adequately achieved.*

### 115. Customer Due Diligence and KYC requirements are comprehensive, and include a

### 115. Customer Due Diligence and KYC requirements are comprehensive, and include a

### Overview
- Customer Due Diligence (CDD) and Know-Your-Customer (KYC) requirements include customers’ identification and due diligence policy, assessment of their risk profile (including politically exposed persons), and policies and processes to identify, monitor and report unusual or suspicious transactions.
- AML/CFT records must be kept and available to the relevant authorities for 10 years.
- DCG 115 contains risk-sensitive approaches that permit enhanced and simplified CDD.
- Provisions 25a and 25a Bis of DCG 115 require banks to classify customers and transactions according to the degree of ML and TF risks.

### Internal AML/CFT framework requirements for banks
- Banks must understand the person who controls the customer and the actual beneficiary of the transaction.
- Banks are required to have internal control mechanisms to monitor and identify unusual transactions.
- Compliance management arrangements and adequate training for staff are mandatory.
- The AML-CFT banks’ internal framework must cover:
  - Compliance manual: policies, criteria, measures and internal procedures for CDD and KYC; criteria, measurement and internal procedures to manage client risk; procedure and criteria for opening, limiting or terminating a business relationship consistent with risk assessment (Provision 64th DCG).
  - Compliance officer: charged with preparing the compliance manual containing the CDD and KYC policies.
  - Communication and Control Committee (Provision 43rd DCG): (i) submit the Compliance manual and modifications for audit committee approval; (ii) receive reports from internal and external audits regarding effectiveness and adopt corrective actions (Provision 60th DCG).

### Customers’ file and Ultimate Beneficial Owner (UBO)
- Provision 4th DCG: banks must prepare and keep an identification file of each client; for firms banks must know shareholding and corporate structure and identify the UBO.
- Identification file must be updated annually and must include at a minimum:
  - Information on the shareholding structure and the internal corporate structure.
  - Identification of UBO of legal entities. If no individual controls the firm, the manager shall be deemed the UBO. If designated administrator is also a legal entity or trust, control is understood to be exercised by the individual appointed by the administrator of the legal entity or trust.
  - Declaration of the legal representative of the firm stating the UBO.
- SHCP and CNBV published Guidelines for the identification of the UBO to establish measures, guidelines and criteria.

### Risk-based supervision, KYC data collection and client classification
- CNBV reinforced the legal framework to perform a risk-based approach to AML/CFT supervision; DCC and KYC supervisory review now mandatory and focused on thematic reviews by risk (such as UBO identification procedures).
- Provisions 23rd and 24th DCG require banks to collect information on amount, number, type, nature, geographic area of operation, frequency of operations, and origin and destination of resources to determine transactional profile.
- Provision 25th Bis DCG: clients must be classified by risk level in at least two categories: high- and low-level; institutions may create intermediate levels. Risk evaluation model is approved by the risk committee.
- Clients must be reassessed every six months, or more frequently if warranted by the risk level.

### Recordkeeping, reporting obligations and systems
- Reporting framework to FIU: reporting of any suspicion of ML and any unusual transaction that is not justified; both actual and attempted transactions must be reported; other reports based on objective monetary thresholds.
- Clear obligation to report transactions suspected of being related to domestic terrorism or its financing (obligation does not extend to suspected financing of international acts of terrorism).
- LIC and sectoral regulations oblige banks and other FIs to keep records for at least 10 years.
- Banks must have automated systems to manage clients’ information and transactions able to classify transactions, detect suspicious operations, produce suspicious reports, generate alerts, and preserve records for 10 years.
- 2021 amendments introduced changes concerning politically exposed persons, due diligence measures, and beneficial owners.

### Suspicious operations reporting (timing and criteria)
- Banks must report unusual operations to SHCP through CNBV within three days of the meeting of the CCC which determined the operations to be suspicious (Provision 37th DCG).
- The determination must be finalized within 60 days from the operation.
- Well-founded suspicions could be reported within 24 hours.
- Identification process could be suspended when the bank reasonably believes that it could prevent or alert the client.
- Provision 38th DCG lists circumstances to consider when determining unusual operations, including: occupation, profession, activity, line of business; unusually high-amount or complex operations; failure to provide information; attempts to bribe, persuade or intimidate staff; extraordinary events with no clear explanation; involvement of jurisdictions with preferential tax regimes; concern about the UBO; etc.
- SHCP regularly advises banks and provides guides, information and typologies to facilitate identification of Unusual Transactions.

### Correspondent banking (EC6)
- DCG Provision 29th: provision of correspondent banking to foreign counterparts must be approved by management; procedures and measures of counterparts on AML/CFT must be documented.
- Banks and FIs must obtain from foreign counterparts:
  - A certification by an independent auditor or, in its absence, a certification by its counterpart stating compliance with similar CDD/KYC obligations.
  - Information enabling the bank to: know the counterpart’s business; assess control mechanisms for international AML/CFT standards; understand supervision by any authority on AML/CFT issues; determine counterpart’s reputation.
- Enhanced scrutiny applies for correspondent banks incorporated in countries or territories where, according to SHCP, AML/CFT policies are deficient or insufficiently applied.
- Engaging in correspondent banking relationships with shell banks is prohibited.
- CNBV gives particular attention to correspondent banking, considering it particularly exposed to high ML risks.

### Supervisory arrangements, methodologies and inspections (EC7)
- CNBV supervisory arrangement is a mix of on-site and off-site activities for ML and includes a dedicated VP for AML (VPSPP) that can perform on-site visits and ongoing surveillance.
- VPSPP human resources include 72 AML/CFT specialists (also stated as 72 employees).
- CNBV conducts three types of on-site visits: (i) ordinary (visitas ordinarias); (ii) special (visitas especiales); and (iii) targeted (visitas de investigación).
- On-site inspections verify internal policies, procedures, internal controls, effectiveness of reporting systems, quality of IT systems, personnel selection processes, and require corrective actions where needed (oficio de observaciones; oficio de medidas correctivas).
- CNBV uses a methodology to assess entities by ML/FT risk considering types of clients, geographic zones, currency and monetary instruments, products/services; each item assigned inherent risk rating for ML and FT.
- Inherent ML and FT risk of each entity: ratings for 3 items are averaged. Final inherent risk = weighted average of ML (70 percent) and FT (30 percent).
- Risk intensifiers and mitigators are applied to increase or decrease inherent risk and assign a rating.
- Intensifiers include FIU reports, breach of regulatory obligations, operations considered high risk, relevant facts from auditors. Mitigants include results of preventive regime revisions.
- ML/FT risk rating is a risk component in the CEFER, making up 70 percent of the legal and reputational risk, which in turn weights 10 percent of the Comprehensive risk in the CEFER.
- CNBV developed dashboards on the SupTech platform to analyze quantitative information and detect risks by customers/users, products/services, countries/geographic areas, and delivery channels.
- AML/CFT Inspection Guidelines published March 2018 and modified October 2021; used to guide supervision and identify required corrective actions.

### Supervisory powers and enforcement (EC8)
- CNBV powers (Article 49 RSCNBV, Article 52 RSCNBV, Article 4 LCNBV): make observations and recommendations; order supervised institutions to take corrective actions; establish actions, corrective measures or mandatory compliance programs; impose administrative penalties.
- Sanctions: reprimands, vetoes, suspensions or disqualification of bank officials, administrative fines; powers include revoking authorization to carry out operations.
- Article 115 LIC establishes sanctions CNBV will apply to banks for violation of DCG applicable to Banks.

### Governance, internal audit, compliance officers, staffing and training (EC9–EC11)
- Banks must set up a Communications and Control Committee that determines policies and procedures; the Committee appoints a Compliance Officer from its members.
- Compliance Officer duties: AML/CFT risk management, interaction with authorities, reporting to Communications committee; must be independent from business units and must not have internal audit mandate.
- DCG mandates training and dissemination programs including: (i) courses at least once a year, especially for front-line officers; (ii) dissemination of DCGs and amendments; (iii) information on techniques, methods and trends to prevent/detect/report ML/TF. Banks must issue certificates proving participation.
- Provision 60 DCG: annual review by internal audit or independent external auditor to evaluate effectiveness of compliance with DCG; results presented to CEO and Committee; reports filed with CNBV within sixty calendar days of the end of the period under review and kept for five years.
- Communications and Control Committee duties include: awareness of high-risk contracts/accounts; establish/disseminate client classification criteria; analyze whether suspicious operations are to be reported; inform competent area about potential infractions; approve training; ensure internal structures/resources.
- Provision 57th DCG: banks must establish mechanisms and systems allowing officials/employees to send warnings about unusual or worrying internal operations directly to compliance unit.
- Provision 51st DCG: banks must have automated systems for staff to report securely, confidentially and traceably to responsible areas.
- LIC and DCG protections: compliance with reporting obligations is not an infringement of confidentiality; reports and information generated by banks shall not be considered an indication of crime perpetration; staff reporting in good faith cannot be held responsible. Provision 57 DCG mandates confidentiality so neither reported staff nor hierarchical superior are aware of the report.

### Information sharing, cooperation and typologies (EC12–EC13)
- Banks send STRs to the FIU through CNBV; transmission is automatic.
- No limitations prevent CNBV from sharing information with domestic authorities within its competence; Art. 97 LIC allows SHCP, Banxico, CNBV, CONDUSEF, IPAB to request and share information; MOUs specify information exchange terms and confidentiality.
- CNBV and FIU meet periodically to discuss AML/CFT matters and review regulatory consistency with international standards.
- CNBV shares outcomes of reviews with the FIU; FIU provides non-compliance ratings used for annual supervision program.
- Article 117 Bis LIC allows CNBV to provide foreign financial authorities with information concerning operations and services under AML provisions; CNBV actively develops MOUs with foreign supervisors; foreign supervisors participate in on-site visits and CNBV staff participate in visits abroad.
- In 2021 CNBV handled 34 requests for information from domestic authorities and 29 requests from foreign authorities, through some 250 official letters and memorandums.
- FIU responsibilities (Article 15 Internal Regulations of the Ministry of Finance and Public Credit): approve AML/CFT typologies, trends and indicators, and guidelines and best practices for preparation and submission of AML/CFT reports; FIU publishes typologies and trends via official website.
- CNBV provides multiple guides via SITI AML/CFT including guides on corruption-derived illicit origin, financing of terrorism, warning and monitoring scenarios, COVID-19 related risks, business email compromise (BEC) and trade-based money laundering, international bribery, electoral processes, and human trafficking financial flows.

### Assessment and conclusions
- Assessment of Principle 29: Largely compliant.
- Comments: Supervision of AML/CFT has significantly improved since the last BCP assessment. CNBV has continued to update regulations and implement new supervisory tools and methodologies. The prior staff shortage has been mostly solved by hiring staff with the right skills.
- Recommendation: CNBV is encouraged to continue advancing towards an AML/CFT full-fledged risk-based supervision.

*Source: 115. Customer Due Diligence and KYC requirements are comprehensive, and include a — IMF content unit 1mexea2023002*

### 1. Responsibilities,

### 1mexea2023002 - 1. Responsibilities, objectives and powers

### Overview
- Overall assessment: Largely Compliant for Core Principle 1 (Responsibilities, objectives and powers) with recommendation to implement an effective consolidated supervision framework to enhance compliance.
- Key governance concern: CNBV governance structure results in direct and significant influence of SHCP on CNBV affairs.
- Several Core Principles assessed as Materially Non-Compliant: Principle 2 (Independence, accountability, resourcing and legal protection for supervisors), Principle 12 (Consolidated supervision), and Principle 19 (Concentration risk and large exposure limits).

### Major governance and independence findings (Principle 2 and related)
- CNBV board composition and appointment:
  - President of CNBV, and 5 out of a total of 13 members of CNBV’s board, are appointed by SHCP.
  - Remaining members appointed by Banxico (three), CONSAR (one), and CNSF (one).
  - The president and two vice presidents of CNBV are also members of the board.
  - There are no independent members—all members are ex-officio.
  - No term appointments for CNBV and board members; no legally established reasons for dismissal and no requirements to disclose reasons for dismissal.
- Historical turnover:
  - Changes in Government have resulted in replacing the President and board members of CNBV.
  - Turnover has been significant among governing board members, especially after presidential elections.
- Budget and autonomy:
  - CNBV has no autonomy to establish/modify its own budget, although supervisory fees collected from institutions have systematically exceeded its budget.
  - Recommendation: grant CNBV effective operational independence, strengthened governance, budget autonomy, and decentralization.
- Legal protection:
  - Law does not grant statutory immunity to CNBV and its personnel for bona fide discharge of functions; other operative protection is granted.
  - LCNBV and LIC require CNBV to provide legal assistance for board members and officers who have discharged their duties according to the law; assistance extended to individuals nominated as special administrators in banks.
  - Over the last five years there have been several lawsuits against CNBV but none against individuals. Since the establishment of the fund in 2005 there has been only one lawsuit against an individual (2006).
  - Current legal protection provisions do not mitigate risks of frivolous actions by third parties—staff is not protected against lawsuits for actions taken while discharging their duties in good faith.

### Consolidated supervision (Principle 1 and Principle 12)
- Financial Groups Law (LAF) of 2014 was an important step but:
  - LAF does not empower supervisors to impose prudential measures at group level.
  - Several domestic financial conglomerates fall outside the scope of consolidated supervisory purposes.
  - Financial conglomerates can legally exist only if they voluntarily request authorization by SHCP to operate as such; authorization is limited to firms declared by the banking group and may exclude some firms.
  - At the time of assessment, there were 7 domestic financial conglomerates that had not requested authorization by SHCP and thus were not subject to the current consolidated supervisory regime.
  - Some de-facto financial conglomerates operate actively domestically and in Latin-American countries through banking subsidiaries under the same brand.

### Supervisory framework, tools and methodology (Principles 3–11, 13–18, 20–29)
- Cooperation and collaboration (Principle 3): Compliant. CNBV has clear powers to exchange information domestically and abroad; relevant MOUs in place or actively used.
- Permissible activities (Principle 4): Compliant. Licensing and use of the word “bank” controlled; LIC contains provisions prohibiting unlicensed deposit-taking.
- Licensing criteria (Principle 5): Compliant. CNBV authorizes universal banking with Banxico's favorable opinion; development banks and financial holding companies licensed by SHCP. Fit-and-proper tests include skills, moral suitability, experience, and no adverse regulatory determination or poor credit record.
- Transfer of significant ownership (Principle 6): Compliant. Legal framework and CNBV protocols prevent transfers without prior control and authorization.
- Major acquisitions (Principle 7): Compliant. CNBV can approve/reject major acquisitions, including cross-border operations; investment limits in non-financial companies seen as adequate.
- Supervisory approach (Principle 8): Largely Compliant. CEFER was a major step toward risk-based supervision; assessors recommend enhancements for better risk assessment.
- Supervisory techniques and tools (Principle 9): Largely Compliant. Supervisory reports are mostly rule-based; risk management and corporate governance assessments lack depth. Deployment of supervisory resources adjusted due to budgetary restrictions (see BCP 2) but CNBV has coped without seriously affecting core activities.
- Supervisory reporting (Principle 10): Compliant. CNBV has a sophisticated system for collecting, reviewing and analyzing prudential reports and statistical returns; technological platform allows comparable management of information across institutions.
- Corrective and sanctioning powers (Principle 11): Largely Compliant. Regime can deliver timely corrective actions, up to intervention and liquidation (suspension of license). CNBV is authorized enforcement agency; can apply fines and administrative penalties including revocation; sanctions against individuals permitted. IPAB is lead agency in liquidation cases. Ring-fencing options to protect banks from indirect risks from non-regulated group entities are limited.
- Corporate governance (Principle 14): Largely compliant. LIC and CUB frameworks are extensive; assessment quality could be enhanced by greater use of expert judgment on timeliness/quality of board data, directors’ time, and collective suitability.
- Risk management process (Principle 15): Largely compliant. Regulations comprehensive; supervision should increase focus on assessing quality of risk management over formal compliance.
- Capital adequacy (Principle 16): Largely compliant. Capital framework broadly consistent with Basel. CNBV has powers to apply Pillar 2 charges but these have never been exercised; assessment team encourages sharpening CEFER before applying Pillar 2 charges.
- Credit risk (Principle 17): Compliant. Adequate regulatory and supervisory framework; emphasis on on-site verification of credit files and borrower creditworthiness; off-site evaluation of credit risk policies and practices.
- Problem assets, provisions, reserves (Principle 18): Compliant. Detailed framework for identification and management of problem assets, classification, provisioning, and write-offs.
- Concentration risk and large exposure limits (Principle 19): Materially non-compliant. Regulation sets different limits depending on actual capital ratio of banks (departs from Basel); lacks formal definition of large exposure. Framework for connected party lending does not empower CNBV to determine connected parties beyond those defined in regulation. Authorities are working on new regulation on large exposures.
- Transactions with related parties (Principle 20): Largely compliant. Gaps from prior FSAPs remain unaddressed; limits for RPTs not aligned with international practice.
- Country and transfer risks (Principle 21): Largely compliant. Further strengthening possible by adopting a more proactive supervision approach.
- Market risk (Principle 22): Compliant. Essential criteria fully achieved.
- Interest rate risk in the banking book (Principle 23): Compliant. Regulation does not differentiate banking/trading books for Pillar 1 but banks required to manage both separately; assessors conclude essential criteria adequately achieved.
- Liquidity risk (Principle 24): Largely Compliant. Regulatory and supervisory framework for liquidity risk well-established; inclusion of LCR and NSFR aligns framework with Basel III. Note: deposit-taking development banks are not subject to current liquidity prudential framework applicable to private banks.
- Operational risk (Principle 25): Largely Compliant. Comprehensive regulations and specialized DGSROT unit. Cybersecurity supervision is still developing and needs staffing and resources.
- Internal control and audit (Principle 26): Compliant. Suitable regulatory and supervisory framework promoting best practices.
- Financial reporting and external audit (Principle 27): Compliant. Legal framework and practices follow international best practices and meet BCP criteria.
- Disclosure and transparency (Principle 28): Compliant. CNBV disclosure requirements align with widely accepted international practices.
- Abuse of financial services / AML-CFT supervision (Principle 29): Largely compliant. Supervision has significantly improved since last assessment; CNBV continues to update regulations and implement new tools and methodologies.

### Key statistics and factual points (verbatim)
- CNBV board: 13 members total; 5 appointed by SHCP; 3 by Banxico; 1 by CONSAR; 1 by CNSF.
- Since establishment of the fund in 2005 there has been only one lawsuit against an individual (2006).
- LAF enacted in 2014.
- At time of assessment, 7 domestic financial conglomerates had not requested authorization by SHCP to operate as financial conglomerates.
- Recommendation to implement the 2016 BCBS standards on large exposures.
- Article 73 of the LIC: current aggregated maximum limit with standard ‘related parties’ is 35 percent of capital.

### Recommended actions (selected, organized by Principle)
- Principle 1 (Responsibilities, objectives and powers)
  - Make application of the consolidated supervision legal framework mandatory for financial groups operating in Mexico.
  - Introduce legal amendments granting authorities power to impose prudential regulations at group level.
  - Amend framework so perimeter of consolidated supervisory framework can be discretionally determined by authorities.
- Principle 2 (Independence, accountability, resourcing and legal protection)
  - Change composition of CNBV governing body, including terms and reasons for removal, to enhance independence from government interference.
  - Grant CNBV greater budgetary autonomy.
  - Strengthen arrangements to ensure effective legal protection for supervisors.
- Principle 5 (Licensing)
  - CNBV to issue internal guidelines detailing criteria to assess financial soundness of significant shareholders and their ability to support banks if needed.
- Principle 8 (Supervisory approach / CEFER)
  - Reduce and simplify indicators and categories used to determine inherent risks.
  - Make assessment of mitigants more dependent on expert judgment rather than formal checks.
  - Introduce internal supervisory routines and decision-making arrangements to foster and unify expert judgment.
- Principle 9 (Supervisory techniques and tools)
  - Set up a quality assurance procedure, including supervisory peer review process, to ensure effectiveness of on-site examinations in assessing risk management.
- Principle 11 (Corrective and sanctioning powers)
  - Enhance ring-fencing options available to protect banks from indirect risks from non-regulated financial entities belonging to the same group.
- Principle 12 (Consolidated supervision)
  - Strengthen the current arrangement for consolidated supervision (see recommendations for Principle 1).
- Principle 14 (Corporate governance)
  - Give more room to expert judgment to assess corporate governance adequacy (refer to recommendations for Principles 8 and 9).
- Principle 15 (Risk management)
  - Increase focus on assessing quality of risk management rather than compliance with requirements.
- Principle 16 (Capital adequacy)
  - Fully implement Pillar 2 capital charges; sharpen CEFER prior to applying Pillar 2.
- Principle 17 (Credit risk)
  - Establish a threshold for large loans that must be approved by the board.
  - Enhance procedures to assess substantive implementation of credit risk management practices, emphasizing actual management.
- Principle 19 (Concentration risk and large exposures)
  - Implement the 2016 BCBS standards on large exposures.
- Principle 20 (Related parties)
  - Amend Article 73 of the LIC to reduce the 35 percent of capital aggregated maximum limit with standard ‘related parties’ to a level consistent with international practice.
  - Provide explicit powers to CNBV to exert discretion on a case-by-case basis.
  - Amend the LAF to require observance of lending limits on a full consolidated basis at the holding company level and extend requirements to unregulated mixed activity holdings.
- Principle 21 (Country and transfer risks)
  - Implement minimum regulatory requirements and reporting related to country and transfer risks.
- Principle 24 (Liquidity risk)
  - Implement minimum liquidity requirements for development banks that take deposits from the public.
- Principle 25 (Operational/cybersecurity risk)
  - Enhance risk-based supervision over cybersecurity risks, particularly staffing and resources to keep abreast of IT development and corresponding risks.
- Principle 29 (AML/CFT)
  - Continue advancing towards an AML/CFT full-fledged risk-based supervision.

*Source: 1mexea2023002 - 1. Responsibilities, objectives and powers — IMF assessment (extracted from provided content).*

### 37. Mexican financial authorities appreciate the effort and dedication that the IMF and the

### 1mexea2023002 - 37. Mexican financial authorities appreciate the effort and dedication that the IMF and the

### Overview
- Mexican financial authorities express appreciation for the IMF and WB assessors and mission chiefs for undertaking the assessment of the implementation of the BCPs in the Mexican financial sector as part of the FSAP.
- The two missions produced discussions described as "insightful" and providing "valuable and useful information on supervision tools and practices."

### Progress since the 2012 BCP assessment
- Since the last BCP assessment was completed in 2012, Mexican financial authorities report significant progress in strengthening banking regulation and supervision and improving compliance with the BCPs.
- The report acknowledges specific improvements:
  - "supervision of AML/CFT has significantly improved"
  - "operational risk regulatory and supervisory framework" has significantly improved
  - "regulations on overall risk management have been greatly enhanced"
  - "compliance with the conditions of the country and transfer risks has been largely achieved"

### Reception of findings and recommendations
- Authorities "welcome the findings and recommendations in the report."
- They "greatly value the feedback provided by the assessors and will make the necessary efforts in adopting most of the recommendations."
- Authorities note it is important to "highlight some considerations for certain grades and recommendations of the report."

### Consolidated supervision framework
- Mexican authorities assert that supervision by the Supervising Commissions (CNBV, CNSF and CONSAR), as specified by the LRAF and the General Rules for Financial Groups, "provides a consolidated supervisory legal framework that is mandatory for financial groups, financial entities integrated into a financial group, and also for companies belonging to financial groups."
- There exists "a prudential framework for financial groups that includes minimum requirements for general administration, risks management, internal control, disclosure of information, leverage, and capital, among others."
- When a potential risk is identified in a financial entity within a financial group, "the Supervising Commissions exchange information under the existing cooperation agreements in order to have a proper and coordinated response."
  - Cooperation includes "the sharing of information collected for the supervisory and surveillance functions of both the financial group and the individual financial entities that comprise it"
  - Cooperation includes "the timely report on any relevant factor that could affect the financial position of the financial group or of any of its entities."

### Mechanisms to prevent risk transference from economic groups
- Mexican regulation sets mechanisms to prevent risk transference from economic group’s entities to financial institutions, including:
  - "exposure limits with related parties"
  - "minimum requirements for transactions between related parties"
- The CNBV has the attribution of:
  - "requiring the necessary information"
  - "enacting cautionary actions (including additional capital requirements) if the economic group’s entities fell into insolvency or illiquidity, financial clean-up or bailout"
  - "as well as under corrective financial actions ordered by an authority."

### CNBV independence, resourcing, and governance
- Budget process:
  - The SHCP "integrates the budget for all the public federal administration institutions, which is then approved by the Legislative branch of government (lower chamber)."
  - CNBV, as a de-concentrated administrative body of the SHCP, "has technical autonomy and executive powers; nevertheless, it also follows the same budget rules of other de-concentrated federal agencies."
- Board appointments:
  - "The SHCP appoints some of CNBV’s board members." Authorities state these procedures "by no means hinder CNBV’s efficacy from supervising financial entities or contributing to the overall financial stability, in collaboration with other supervisory agencies."
- Institutional assessment:
  - "This institutional framework has proven efficiency and stability over the years, and it does not prevent CNBV’s governing board or staff to fulfill their main mandate."

### Supervisory approach and the CEFER tool
- On the Core Principle “Supervisory approach,” assessors recommended for the CEFER tool that:
  - "...mitigants should rely more on expert judgement rather than on formal checks..."
  - in order to "... facilitate applying a more risk-based approach to supervision, facilitating the application of Pillar 2 measures..."
- CNBV response:
  - CNBV points out that "the mitigants’ grade is obtained by the application of the supervision procedures, which since 2015 have been part of a reengineering process with the purpose of carrying out a risk-based supervision"
  - In this approach "through questions and hints the supervisor determine the root cause of the findings and thereby establish corrective actions to prevent and mitigate risks."

### Commitment and next steps
- Authorities "reaffirm their commitment to continue advancing, in the scope of its mandate and attributions, towards the full compliance with the BCPs."
- They "look forward to continuing the dialogue with the IMF and WB, and recognize the excellent work of both organizations in carrying out these assessments."

*Source: 1mexea2023002 - 37. Mexican financial authorities appreciate the effort and dedication that the IMF and the*

---


_Source: https://www.imf.org/-/media/files/publications/cr/2023/english/1mexea2023002.pdf_