Mexico's Comisión Nacional Bancaria y de Valores (CNBV) published updates to the general provisions governing credit institutions on 14 June 2024, defining 'observable conducts for fraud management' (internal or external conduct against customers such as identity theft, theft of personal and financial data, impersonation of the bank, insider misuse of customer information, malware and cheque fraud) and requiring banks to adopt a fraud prevention management plan and apply stricter authentication measures when dealing with customers. The resolution's stated aim is to strengthen internal control on fraud by setting a clear legal framework for 'observable conducts for fraud management', giving legal certainty to banks and the CNBV and underpinning supervision of fraud prevention, detection and response.
The provisions require banks to set out in a fraud prevention management plan how they identify, measure, monitor and respond to these conducts.
AUTHENTICATION STANDARDS TIGHTENED FOR CUSTOMERS
The updated provisions also introduce stricter authentication requirements for interactions with banking customers. The rules introduce a 'Monto Transaccional del Usuario' (a reference transaction amount defined by the customer or, if the customer does not set one, estimated by the bank): changing it through electronic channels requires two authentication factors of different categories, and transactions above it require an additional authentication factor.
STATED OBJECTIVES
The CNBV indicated that the regulations are also designed to strengthen internal controls within credit institutions, provide greater legal clarity around the obligations that banks bear in respect of fraud prevention, for the benefit of financial stability and users of financial services.