public disclosure authorized - world bankdocuments.worldbank.org/curated/en/... · comprobante...

CONFIDENTIAL FOR RESTRICTED USE ONLY (NOT FOR USE BY THIRD PARTIES)

FINANCIAL SECTOR ASSESSMENT PROGRAM

MEXICO

SISTEMA DE PAGOS ELECTRÓNICOS INTERBANCARIOS (SPEI) ASSESSMENT OF OBSERVANCE OF THE CPMI-IOSCO PRINCIPLES FOR FINANCIAL MARKET INFRASTRUCTURE

JULY 2016

THE WORLD BANK GROUP FINANCE & MARKETS GLOBAL PRACTICE LATIN AMERICA AND THE CARIBBEAN VICE PRESIDENCY

Pub

lic D

iscl

osur

e A

utho

rized

Pub

lic D

iscl

osur

e A

utho

rized

Pub

lic D

iscl

osur

e A

utho

rized

Pub

lic D

iscl

osur

e A

utho

rized

CONTENTS I. EXECUTIVE SUMMARY ...................................................................................................... i II. INTRODUCTION ................................................................................................................... 1 III. OVERVIEW OF THE PAYMENT, CLEARING AND SETTLEMENT LANDSCAPE ...... 2 IV. SUMMARY ASSESSMENT .................................................................................................. 5 V. DETAILED ASSESSMENT REPORT ................................................................................. 11 Principle 1: Legal basis ................................................................................................................ 11 Principle 2: Governance ............................................................................................................... 16 Principle 3: Framework for the comprehensive management of risks ........................................ 25 Principle 4. Credit risk ................................................................................................................. 30 Principle 5. Collateral .................................................................................................................. 34 Principle 7: Liquidity risk ............................................................................................................ 36 Principle 8: Settlement finality .................................................................................................... 42 Principle 9: Money settlements .................................................................................................... 45 Principle 13: Participant-default rules and procedures ................................................................ 46 Principle 15: General business risk .............................................................................................. 49 Principle 16. Custody and investment risks ................................................................................. 51 Principle 17: Operational risk ...................................................................................................... 53 Principle 18. Access and participation requirements ................................................................... 63 Principle 19. Tiered participation arrangements .......................................................................... 67 Principle 21: Efficiency and effectiveness ................................................................................... 68 Principle 22: Communication procedures and standards ............................................................. 71 Principle 23: Disclosure of rules, key procedures, and market data ............................................ 72 VI. BANCO DE MEXICO’S RESPONSE TO THE ASSESSMENT ........................................ 74 Table 1: Ratings Summary of the Principles ................................................................................. 7 Table 2: List of Prioritized Recommendations for the FMI .......................................................... 7 Figure 1: The Mexican National Payments System ....................................................................... 2

GLOSSARY ACH Automated clearinghouse AML Anti-money laundering BANXICO Banco de México BIA Business impact analysis BCMS Business Continuity Management System BCP Business continuity plan BMV Bolsa Mexicana de Valores BONDES Bonos de Desarrollo del Gobierno Federal BREMS Bonos de Regulación Monetaria CASP Centro de Atención de los Sistemas de Pagos CCEN Cámara de Compensación Electrónica Nacional CECOBAN Cecoban, S.A. de C.V. CETES Certificados de la Tesorería CFT Combating the financing of terrorism CCP Central counterparty CCV Contraparte Central de Valores de México, S.A. de C.V. CD Certificates of deposit CEP Comprobante electrónico de pago CLS Continuous Linked Settlement CNBV Comisión Nacional Bancaria y de Valores COAS Cliente de Operación Alterno del SPEI COSO Committee of Sponsoring Organizations of the Treadway Commission CSD Central securities depository CONSAR Comisión Nacional del Sistema de Ahorro para el Retiro CNFS Comisión Nacional de Seguros y Fianzas CPMI Committee on Payments and Market Infrastructure (formerly CPSS) CPSS Committee on Payment and Settlement Systems DGTI Dirección General de Tecnologías de la Información DNS Deferred net settlement system DSP Dirección de Sistemas de Pagos DVD Delivery versus delivery DVP Delivery versus payment ETF Estaciones de trabajo fortalecidas FMI Financial Market Infrastructure FSAP Financial Sector Assessment Program ILS Inyección de Líquidez Manual IMF International Monetary Fund INDEVAL S.D. Indeval Institución para el Depósito de Valores, S.A. de C.V. IOSCO International Organization of Securities Commission IPAB Instituto para la Protección al Ahorro Bancario ISO International Standards Organization IT Information technologies KC Key consideration LFGTOC Ley General de Títulos y Operaciones de Crédito LTOSF Ley para la Transparencia y Ordenamiento de los Servicios Financieros MXN Mexican peso PFMI Principles for Financial Market Infrastructures POA Procedimiento de Operación Alterno

PVP Payment versus payment RTGS Real time gross settlement system RSP Módulo Reportos para Proporcionar Liquidez al Sistema de Pagos RTO Recovery time objective SHCP Secretaría de Hacienda y Crédito Público SLA Service-level agreement SIAC Sistema de Atención a Cuentahabientes SML Securities Market Law SOA Operacion en Sitio Alterno SPEI Sistema de Pagos Electrónicos Interbancarios SPEUA Sistema de Pagos Electrónicos de Uso Ampliado SPID Sistema de Pagos Interbancarios en Dólares SSS Securities settlement system STP Straight-through-processing SWIFT Society for Worldwide Interbank Financial Telecommunication TESOFE Tesorería de la Federación TOR Terms of reference USD US dollar VPN Virtual private network WB World Bank

i

I. EXECUTIVE SUMMARY 1. The Sistema de Pagos Electrónicos Interbancarios (SPEI) is an important pillar of a complex payment and securities settlement infrastructure, through which the payments of various markets are settled with finality. SPEI is a near real-time, hybrid electronic funds transfer system owned and operated by Banco de Mexico (hereinafter, Banxico). It began operations in 2004 replacing the previous system known as Sistema de Pagos Electronicos de Uso Ampliado (SPEUA). SPEI processes large-value and retail payments alike, and currently supports 15 different types of payments. SPEI provides settlement facilities for a number of payment systems, including the Mexican peso leg of foreign exchange transactions settled at Continuous Linked Settlement (CLS) Bank. Through SPEI, the Sistema de Depósito, Administración, y Liquidación de Valores (DALÍ) – the securities settlement system operated by INDEVAL – conducts its money settlements in central bank money based on Model 3 Delivery versus Payment (DVP). In addition, two payment card switches (Prosa, E-Global), and the recently-established mobile payments clearinghouse (Sociedad Operadora de Pagos Móviles, OPM) also settle their net balances in SPEI, although they are not interfaced with Banxico. The Treasury of the Ministry of Finance (TESOFE) is a heavy user of SPEI, and has played a crucial role in the system’s growth. In parallel, other systems and processes settle directly in Banxico’s general ledger system (Sistema de Atención a Cuentahabientes, SIAC) – also a systemically important payment system – which has other important functions, such as the implementation of the monetary policy and intraday liquidity provision. 2. In 2015, SPEI processed transactions for the equivalent of 10 times the country’s GDP. Volumes have been growing by an annual average rate of 32 percent over the past five years. In 2015, SPEI settled of 1.3 million transactions on average per day. SPEI operates on a continuous basis, 24 hours a day, 7 days a week, and supports straight-through-processing (STP) thus allowing crediting customers’ accounts within seconds from settlement. SPEI’s hybrid settlement mechanism allows optimizing liquidity through netting, while settling payments virtually in real-time – i.e., every 1.9 seconds on average. SPEI’s effectiveness is measured against system availability and recovery time targets: in 2015, system availability was 99.98 percent, and recovery time was measured at 30 minutes from the disruption. As of April 2016, there were a total of 106 participants, including Banxico, of which 45 are commercial banks and 18 are broker-dealers, and the rest represent a wide range of supervised non-bank financial institutions. 3. SPEI largely observes the PFMI. It is supported by well-founded legal basis, and sound governance arrangements. It has developed a comprehensive risk management approach with an emphasis on operational risk management. Business continuity and information security policies are shaped according to internationally-accepted commercial standards. In light of its design, it has limited exposure to financial risks, although it does take these risks into account and mitigates them to a great extent. It fulfills a critical role in the national payments system and the financial markets, and has facilitated the participation of a wide range of financial institutions. Banxico pursue a sensible policy of recovering operational costs in full, while decreasing participants’ fees over time. Banxico has disseminated SPEI’s key rules and procedures, and other materials; also, it has completed the CPMI-IOSCO Disclosure Framework. 4. At the same time, a few areas and opportunities for improvement have been noted in this report in light of enhancing PFMI observance. Some of these opportunities relate to enhancing the comprehensive risk management framework to incorporate risks that, although

ii

do not stem from SPEI’s processes (e.g. credit and liquidity risk, participants’ default rules and procedures with regard to intraday repo), have a bearing on its funding and settlement flows. In this regard, international standards require that the haircut methodology also incorporate assumptions of collateral value in extreme market conditions, and is independently validated. SPEI’s governance, its efficiency and transparency would benefit from a formal participants’ consultation mechanism; among other objective, this body would ensure access to the FMI decision-making by all participants on an equal footing. Risk management governance could be strengthened in light of the emphasis that the PFMI place on this issue, and without prejudice to the Board’s and Governor’s roles and responsibilities, by obtaining the Board’s endorsement of SPEI risk management policy including risk-tolerance. Banxico should consider articulating the risk-based access requirements, and establishing specific procedures for facilitating the suspension and orderly exit of a participant that breaches, or no longer meet, these requirements. Finally, other relatively minor suggestions have been provided that could be taken up in the normal course of business.

1

II. INTRODUCTION Assessor and objectives 5. This report contains the assessment of the Sistema de Pagos Electrónicos Interbancarios (SPEI) owned and operated by Banxico. This assessment was undertaken in the context of the IMF-WB Financial Sector Assessment Program (FSAP) to Mexico in April and May 2016. The assessor was Maria Teresa Chimienti, World Bank Group. The assessor would like to thank the Mexican counterparts for their excellent cooperation and generous hospitality. 6. The objective of the assessment has been to identify potential risks related to the financial market infrastructure (FMI) that may affect financial stability. While safe and efficient FMIs contribute to maintaining and promoting financial stability and economic growth, they may also concentrate risk. If not properly managed, FMIs can be sources of financial shocks, such as liquidity dislocations and credit losses, or a major channel through which these shocks are transmitted across domestic and international financial markets. Scope of the assessment 7. The scope of the assessment includes one systemically important payment system. SPEI is assessed against all relevant principles of the PFMI. Banxico operates another systemically important payment system – SIAC. Although this system falls outside of the scope of this assessment, relevant aspects of SIAC that have a bearing on SPEI’s operations have been taken into account. A detailed assessment of SIAC against the PFMI was not undertaken. In light of the limited scope of this assessment, a jurisdictional assessment of the Authorities’ Responsibilities was not undertaken. Methodology and Information used for the Assessment 8. The information used in the assessment includes relevant national laws, regulations, rules, and procedures governing the system and other available material. Other available material included annual reports, SPEI disclosure framework, websites of Banxico and other stakeholders; and other relevant documents. The assessment also benefited from discussions with systems’ participants. 9. The authorities prepared and shared the CPMI-IOSCO Disclosure Framework for SPEI. Additional references to those shared in the disclosure framework became relevant in the course of the discussions, and were shared with the assessor by the Banxico’s team. 10. This assessment is based on information available as of May 2016. Information available after May 2016 as well as planned reforms that had not been completed by May 2016 have not been taken into account in determining the assessment ratings.

2

III. OVERVIEW OF THE PAYMENT, CLEARING AND SETTLEMENT LANDSCAPE

12. Banxico has taken a lead role in developing a comprehensive national payments system (NPS). Banxico itself operates a number of the systems that comprise the Mexican payment, clearing, and settlement landscape, SPEI being at the core of NPS (see Figure 1).

Figure 1: The Mexican National Payments System

• In addition to SPEI, systemically important payment systems comprise the Sistema de

Atención a Cuentahabientes, SIAC – a central bank-operated system for managing the current accounts that financial institutions and other public sector entities keep at Banxico through which it implements the monetary policy and also administers intraday liquidity. SIAC is a real-time gross settlement (RTGS) system, and has been operating since 1990. It fulfills the criteria set out in Payment Systems Law, thus is listed as one of the systems to which the Law applies. Every month, SIAC processes 219 payment per day on average, for a total value of MXN 30,266 million.

• INDEVAL is the only authorized central securities depository (CSD). It provides deposit and custody services for all securities registered in the Registro Nacional de Valores (RNV) and traded on Mexican financial markets. It operates a securities settlement system (SSS) – Sistema de Depósito, Administración, y Liquidación de Valores (DALÍ). DALI settles all kinds of operations with Mexican securities, which include government and private bonds, and equities. DALI also settles operations with foreign securities. INDEVAL also provides sub-custody services through cross-border CSD links. In addition, DALI provides securities lending and borrowing services. Balances in the DALI cash accounts are at all times fully backed by deposits in central

3

bank money in SPEI. DALI is a payment system1 according to the criteria of the Payments System Law. DALI’s operations reach 15,000 per day, for an average value of about MXN 3,005 trillion.

• Contraparte Central de Valores de México, S.A. de C.V. (CCV) is a central counterparty (CCP) for stocks traded on the Bolsa Mexicana de Valores (BMV). CCV is operated by the BMV who is also its main shareholder. CCV is a direct participant in DALI. CCV does not qualify as a payment system under the Payments System Law.

• ASIGNA Compensación y Liquidación (ASIGNA) is the CCP for all derivatives contracts traded on MEXDER market and, starting in 2014 owing to a change in the regulatory framework, on trading platforms. ASIGNA is also a subsidiary of BMV. ASIGNA is not covered under the Payments System Law.

• Banxico provides trade repository (TR) services, consistently with its mandate to foster financial sector development and the smooth functioning of the payment systems.

13. In April 2016, Banxico launched the Sistema de Pagos Interbancarios en Dólares (SPID) with the objective to facilitate and increase the efficiency of local USD-denominated interbank transfers. This system allows reducing the heavy reliance on correspondent banks in the US and on cheques in USD. SPID participants are banks that offer USD accounts to legal persons in Mexico, and that meet enhanced anti-money laundering/combating the financing of terrorism (AML/CFT) requirements. Banks maintain USD account in SIAC which they use to fund their USD settlement accounts in SPID. The system allows no credit between participants or with Banxico. 14. There are a number of private sector and central bank-operated retail payment systems, which are listed below:

• Cámara de Compensación Electrónica Nacional (CCEN) is an automated

clearinghouse authorized by Banxico to clear and settle cheques, interbank bank credit transfers and debit transfers on a T+1 basis. It is owned and operated by CECOBAN whose shareholders are 37 financial institutions. Net balances are settled with finality in SIAC.

• PROSA and E-Global are two inter-connected payment card switches operated by two different consortiums of banks. Both settle net balances in SPEI, although they are not interfaced with Banxico.

• Sociedad Operadora de Pagos Moviles de Mexico (OPM) is a recently licensed (March 2015) clearinghouse for mobile-initiated bank transfers. It is owned by two banks and a mobile network operator. OPM settles in SPEI although it is not interfaced with this system.

• Directo a Mexico is a service that allows sending money from a bank account in the US to any bank account in Mexico by establishing a direct link between the Mexican and American payment systems. Directo a Mexico was set up by Banxico and the US.

1 DALI is a securities settlement system, the term “payment system” in the Payments System Law refers to a systemically important financial market infrastructure.

4

Federal Reserve. Since 2003, the system can be used to send government pension payments to recipients in Mexico. As of 2004, payments can be sent from any enrolled USA financial institution to any individual with a bank account in Mexico. Mexican migrants to the US can also send remittance payments to any of the 2,200 L@ Red de la Gente branches to beneficiaries in Mexico.

Regulation, supervision and oversight of FMIs 15. The authorities responsible for the regulation, supervision and oversight of FMIs in Mexico are the Ministry of Finance and Public Credit (Secretaría de Hacienda y Crédito Público, SHCP) – for the CSD/SSS and CCPs, the National Banking and Securities Commission (Comisión Nacional Bancaria y de Valores, CNBV) – for the CSD/SSS and CCPs, and Banxico for payment systems and FMIs in general. 16. The faculties of Banxico to regulate and oversee payment systems are grounded in the Banco de México’s Law and the Payments System Law. With regard to CSD/SSS and the equity CCP, the Securities Market Law (SML) entrust the SHCP with the licensing of these FMIs, and provides Banxico with broad powers to regulate and supervise them in conjunction with the CNBV (e.g. prior authorization of internal regulations and amendments). It is worth noting that by law Banxico participates in INDEVAL’s Board of Directors as an independent member. Finally, the Tripartite Rules (Reglas a las que habrán de sujetarse los participantes del mercado de contratos de derivados) issued by the SHCP, the CNBV, and Banxico also confer to the latter extensive regulatory and supervisory powers with regard to the derivatives CCP, some of them it exercises together with the CNBV. The regulation of the TR function rests on Banxico’s Rules for Derivatives Transactions, which require financial institutions to report all their derivatives transactions to Banxico.

17. Banxico regulates and oversees retail payment systems on the basis of Banco de México’s Law, the Ley para la Transparencia y Ordenamiento de los Servicios Financieros (LTOSF) and a number of central bank regulations including Circular 3/2012 (Disposiciones Aplicables a las Operaciones de las Instituciones de Crédito y de la Financiera Rural), Circular 4/2014 (Reglas Aplicables a las Cámaras de Compensación para Pagos con Tarjeta), and Circular 3/2013 (Reglas para Cámaras de Compensación de Transferencias a través de Dispositivos Móviles).

Planned reforms 18. For the last several years, Banxico has been working to improve the functionality of SPEI to conform to market needs. Since the last FSAP, the following developments are worth noting in the context of this assessment: (i) the expansion of the operating hours to a 365/24/7 operating scheme – among other objectives, this development enables the efficient provision and interoperability of mobile-based transfer services; (ii) the reform of the pricing policy which resulted in decreased participants’ fees; (iii) the application of the PFMI which, among other aspects, has led to the development of a comprehensive risk management framework and the publication of the CPMI-IOSCO disclosure framework; and (iv) related to the previous point, the development of (draft) policy and functions of Banxico with respect to FMIs, including central bank-operated systems such as SPEI.

19. To complete the “SPEI vision” Banxico has committed to enhancing further the operational risk management of SPEI, with an emphasis on business continuity (e.g. by further

5

enhancing backup infrastructure) and information security, as well as scalable capacity. In addition, Banxico has identified the need to elaborate more detailed rules particularly for situations of non-compliance, and to establish a formal participants’ consultation/feedback mechanism. IV. SUMMARY ASSESSMENT 20. At the outset, it should be noted that SPEI is a robust and sound FMI. It has adopted international best practices and standards in all of the PFMI areas, particularly with regard to legal basis, governance, operational risk management, access, efficiency, and transparency – and fully observes several of the principles that are applicable to it. 21. Five of the principles that are applicable to SPEI have been assessed as “broadly observed”. These indicate non-serious issues of concern in the area of risk management governance, stakeholders’ involvement (a cross-cutting issue to governance, efficiency, and transparency), comprehensive risk management framework, and risk-based participation requirements and orderly exit. None of the principles applicable to SPEI were assessed as “partly observed” or “not observed”. 22. The principles that were assessed as “broadly observed” and the rationale are described below: • Principle 2 – Governance. Banxico has an explicit commitment towards the safety and

efficiency (i.e. “smooth functioning”) of the payment system as a whole. This is laid down in article 2 of the Banco de México’s Law and supported in SPEI’s legal basis. SPEI’s governance derives from Banxico Internal Regulations and the Administrative Units Ascription Agreement whereby the Directorate General of Payment Systems and Corporate Services is entrusted with the administration of SPEI through the Payment System Department. The Banco de México’s Board of Governors has broad powers to decide upon internal policies as appropriate, but unlike internal audit, the risk management function does not report directly to the Board of Governors. In light of the emphasis that the PFMI place on risk management governance (Principle 2, KC 7), and without prejudice to the Board’s and Governor’s roles and responsibilities2, it is recommended that SPEI risk management policy including risk-tolerance be endorsed by the Board of Governors. Banxico informs SPEI participants prior to implementing system changes. However, there is no obligation to collect participants’ opinions, nor did Banxico establish a formal mechanism for consultations.

• Principle 3 – Framework for the comprehensive management of risks. The main

risk that Banxico has identified relates to operational issues that could disrupt system’s operations. The framework for management of risks in SPEI is stipulated in the “Framework for the Comprehensive Management of Risks applicable to SPEI”, dated March 2016. This framework set out the procedures for risk identification and periodic evaluation. Risk management relies on preventive control measures including policies, procedures, and manuals. The scope of SPEI’s risk management framework includes the risks that arise in the system, those that derive from interdependencies with other

2 See CPMI, “Application of the Principles for financial market infrastructures to central bank FMIs”, August 2015.

6

systems, as well as those posed by the participants. On the other hand, Banxico should take a more integrated approach to risk identification and evaluation including of financial risks to the extent relevant to SPEI, and ensure that risk controls are applied consistently. The operational risks from interdependent FMIs are managed under the umbrella of business continuity arrangements that include all systems operated by Banxico and through the participants’ alternate operating procedure. SPEI provides participants with both positive and negative incentives to manage appropriately their risks.

• Principle 5 – Collateral. SPEI as such does not undertake credit risk; however,

Banxico is exposed to credit risk to the extent that it provides intraday liquidity through repos. On the other hand, current account overdrafts do not have any credit risk implications being these fully collateralized with cash at the central bank (e.g. depósitos de regulación monetaria). To mitigate credit risk from intraday repos, Banxico requires highly liquid collateral characterized by low credit and market risk. Collateral securities are marked-to-market daily, and Banxico’s valuation practices are prudent. Haircuts are conservative and have proved stable over time. The haircut ratios are updated once every three months. However, Banxico does not incorporate hypothetical extreme price moves in the haircut methodology. Moreover, the latter is not independently validated. The collateral management system (Módulo de Reportos para Proporcionar Liquidez al Sistema de Pagos, RSP) is operated efficiently through a link with the central securities depository and securities settlement system.

• Principle 18 – Access. SPEI open access and participation requirements facilitate the

broad subscription of the system by Mexican financial institutions (as long as regulated). Participation requirements are risk-based and justified in light of the systemically important nature of the system. However, these requirements are not publicly disclosed beyond a general requirement for prospective participants to certify, at Banxico’s discretion, their technical preparedness to operate in the system. Finally, although Banxico’s powers to suspend or terminate a participant are clear, there are no clearly defined and publicly disclosed procedures for facilitating the suspension and orderly exit of a participant that breaches, or no longer meet, SPEI participant requirements.

• Principle 21 – Efficiency. Through SPEI, Banxico has been effective in

accommodating the payment and settlement needs of Mexican financial institutions, and it proactively sought market development opportunity (e.g. through interoperability of mobile payments). All participants interviewed have confirmed that the system meets their needs and shared positive feedback. Non-bank financial institutions report to have benefited greatly from direct access to the payment system, particularly in terms of cost-efficiency. At the same time, it is perceived that stakeholder involvement is uneven. A structured feedback mechanism with broad participation would help ensure that multilateral discussions are held regularly and reflect the views and opinions of a significant share of SPEI participants.

7

Table 1: Ratings Summary of the Principles

Assessment category Principle Observed Principles 1, 4, 7, 8, 9, 13, 15, 16, 17, 22, 23 Broadly observed Principles 2, 3, 5, 18, 21 Partly observed Not observed Not applicable Principles 6, 10, 11, 12, 14, 19, 20, 24

Table 2: List of Prioritized Recommendations for the FMI

Principle Issues of Concern

and Other Gaps or Shortcomings

Recommended Action Relevant Parties

Comments and Priority

2 Currently, participants’ notification and consultation rely on informal mechanisms.

In consideration of the wide subscription of SPEI services by a diverse set of financial institutions, establish a Users’ Group or similar mechanism to facilitate stakeholders’ access and inputs to SPEI decision-making on an equal footing (see also Principle 21).

Banxico In a defined timeline (< 1 year). It is understood that Banxico is in the process of developing terms of reference (TORs) for the participants’ forum.

2 The PFMI emphasize the independence and access to the board of an FMI’s risk management and audit functions (P2, KC7). Unlike the latter, risk management does not report to the Board of Governors. The Board has broad powers to decide upon internal policies as appropriate.

In light of PFMI emphasis on risk management governance, and without prejudice to the Board of Governors’ and the Governor’s roles and responsibilities, SPEI’s risk management policy including risk-tolerance should be endorsed by the Board.

Banxico In a defined timeline (< 1 year).

3 Identification and evaluation of risks (e.g. business impact analysis, risk map), and the risk controls that have been devised under the Comprehensive Risk Management Framework applicable to SPEI address mostly risks of an operational nature.

Financial risks to the extent relevant should be embedded in SPEI’s risk management framework. For example, RSP limits, collateral valuation practices, and haircut methodology are the relevant risk management measures of Banxico’s exposures to credit risk as a result of providing intraday repos to SPEI’s participants. These measure should be integrated in / coordinated with the broader risk management framework.

Banxico In a definite timeline (< 1 year).

5 Haircuts do not incorporate hypothetical extreme price moves.

Incorporate assumptions about collateral value during stressed market conditions into the haircut methodology and undertake regular stress testing.


8





5 An independent validation of the haircut methodology is not available.

International standards recommend that haircut procedures should be independently validated at least annually.


18 SPEI rules refer to a certification of technical preparedness to participate in the system, but do not elaborate on risk-based participant requirements.

Compile and disclose risk-based participation requirements in SPEI


18 Banxico has powers to suspend or terminate a participant that in Banxico’s determination poses a risk to the system or does not comply with system’s requirements. However, suspension and orderly exit procedures are missing.

Define and publicly disclose procedures for facilitating the suspension and orderly exit of a participant that breaches, or no longer meet, SPEI participant requirements.

Banxico In a definite timeline (< 1 year)

21 While Banxico has been generally responsive to market needs, it has not yet implemented a formal / structured feedback mechanism.

Implement a formal / structured feedback mechanism through a Users’ Group/participants forum with representation from all categories of participant (see also Principle 2).


7 Banxico’s regulations require that repos between credit institutions and broker-dealers with funds from repos with Banxico have the same characteristics as the latter repos, and increase the intraday credit limits applicable to banks who provide this facility, the conditions including amount and pricing of intraday repos with broker-dealers depend on each bank’s policies.

Continue to monitor the conditions of the provision of repos to broker-dealers using funds from repos with Banxico, with a view to ensure that this tool can be used efficiently when needed.

Banxico In the normal course of business.

8 Unsettled (pending) payments may be revoked until they are settled with finality, including topology T payment instructions. The 2012 FSAP recommended that topology T be reviewed since most systems do not notify incoming payments that have not yet settled with finality.

Alternatively, Banxico could consider requiring the consent of the beneficiary institution for the revocation of a payment instruction initiated with topology T (and of which the beneficiary institution has received notification).

Banxico In a definite timeline (< 1 year). Banxico will analyse the convenience of eliminating topology T.

16 A disclosure framework is not available for DALI.

DALI should be assessed at frequent intervals and the disclosure of its rules, key procedures, and market data according to the CPMI-IOSCO

Regulatory and supervisory authorities, INDEVAL

9





disclosure framework format enforced

17 Service-level targets have been established for CASP; SPEI’s availability and recovery time are tracked. However, service-level targets concerning SPEI’s core processes have not been formalized.

Formalize service-level targets for SPEI main services (e.g. processing speed)


17 The system runs on one server; in an extreme yet plausible scenario, delays can occur that can jeopardize (near) real-time settlement.

SPEI capacity planning should aim to achieve a sufficient level of confidence that service-level objectives (e.g. required processing speed) will be maintained under a wide range of plausible stress scenarios.

Banxico In the normal course of business. It is understood that Banxico is exploring options to move to multiple servers.

21 SPEI processes low-value payments, of which most are customer-to-customer interbank transactions – in fact, these payments represent the second most important payment type by volume. However, indicators of usage and cost-efficiency for final users are not embedded in the formal mechanisms for the regular review of the system’s efficiency and effectiveness.

Consider establishing and tracking indicators of usage and cost-efficiency of SPEI for users as part of the formal mechanisms for the regular review of its efficiency and effectiveness

Banxico In the normal course of business.

21 Banxico did not publish a disclosure framework for SIAC. There is a strong interdependence between SIAC and SPEI, e.g. for the provision of intraday liquidity.

Banxico should complete and publish de CPMI-IOSO Disclosure Framework for SIAC with the objective to enhance transparency on the services provided by Banxico through SIAC that have a direct bearing on SPEI’s operations.

Banxico In a definite timeline (< 1 year). Banxico published the document “Policy and functions of Banco de Mexico with respect to FMIs” which addresses these issues. Besides, Banxico has plans to update the SIAC´s assessment against the PFMI in the midterm (the currently published SIAC´s assessment is against the core Principles).

22 Banxico does not use international communication standards, although it accommodates SWIFT for CLS payments and for Mexican banks’ correspondent

Evaluate on a regular basis the opportunity to migrate to internationally accepted communication standards. This issue is a candidate topic for discussion and consultation in the context of the envisaged /

Banxico Banxico has asked SPEI participants several times regarding the convenience of using a standard (e.g. Swift),

10





banking services (for further credit transactions).

recommended participants’ forum.

participants have expressed preference for the current communication protocol. However, Banxico will continue to discuss with participants, through the participants’ forum, the convenience of adopting an international standard.

23 De facto, SPEI provides timely notice to participants of material changes in SPEI rules and procedures that may affect participants’ operations. However, SPEI rules and procedures do not require notification of changes.

Include in SPEI rules a clear obligation to notify participants with respect to both changes in rules and fees. Specify and formalize the process for consulting SPEI participants and other relevant parties as appropriate about the proposed changes (e.g. timeline of the consultation process and the tools that will be used for obtaining participants’ feedback).


23 Variable fees are attached to the SPEI Rules. Fixed fee are dependent upon Banxico’s determination of its operating costs and the volumes transacted (see SPEI Rules).

Banxico could consider increasing transparency on SPEI operating costs as a basis for the calculation of the annual fixed fee.

11

V. DETAILED ASSESSMENT REPORT PRINCIPLE 1: LEGAL BASIS An FMI should have a well-founded, clear, transparent, and enforceable legal basis for each material aspect of its activities in all relevant jurisdictions. Key consideration 1 The legal basis should provide a high degree of certainty for each

material aspect of an FMI’s activities in all relevant jurisdictions. Description Material aspects and relevant jurisdictions

The legal framework supporting SPEI activities is comprised of the Banco de México’s Law, and the Payments System Law. Material aspects for SPEI are: (i) finality and irrevocability of payments, and, SPEI being a hybrid system, (ii) netting. In addition, although from an operational standpoint intraday liquidity (collateralized repos and current account overdrafts) through which Banxico supports financial institutions’ liquidity management is not provided through SPEI, these have a bearing on SPEI participants and its operations. Therefore, enforceability of securities interests provided under repo agreements also qualify as material aspects. The only relevant jurisdiction for all aspects identified above is Mexico. Legal basis for each material aspect Art. 2 of the Banco de México’s Law confers to Banxico the powers to regulate payment systems to fulfill its mission to ensure its smooth functioning (see art. 2). The Law entrust Banxico with the regulation of payment systems (art. 3). Banxico may also regulate fund transfer services provided by credit institutions or other service providers (art. 31), and is entitled to supervise financial intermediaries and the entities that it regulates to ensure compliance including through inspections. Although Banco de México’s Law does not explicitly address the role of Banxico as payment system operator, Payments Systems Law, recognizes this function, according to its finalities and functions. Art. 7, par. I and II represent the basis for operations involving securities and for granting credit to the Federal Government, the credit institutions, and the deposit insurance institution (Instituto para la Protección al Ahorro Bancario, IPAB). The peso accounts (cuentas únicas) that credit institutions must maintain at Banxico (to be used for the settlement of balances with Banxico or authorized by Banxico) are regulated in Circular 3/2012, art.113. These accounts do not generate interest. Art. 114-115 regulate collateralized and, exceptionally, uncollateralized overdrafts. Art. 114 in particular authorizes the use of the monetary regulation deposits to guarantee overdrafts, in addition to deposits resulting from open market operations and from the process of the calculation of the reference interest rate (TIIE), and deposits in USD at Banxico. In the event of end-of-day negative balance on the cuenta unica, art. 113 establishes that Banxico will apply a penalty fee

12

equal to two times the market rate. The Payments System Law provides the legal basis for each material aspect of SPEI with a high degree of certainty. First, being SPEI a central bank-operated system, it automatically falls under the definition of payment system of the Payments System Law (art. 2 par. VIII). Art. 3 lists the criteria to be met for payment schemes and arrangements to quality as payment systems under the definition of the Law. The Law requires that Banxico publish the list of “recognized” systems on an annual basis. Chapter II of the Payments System Law defines the conditions to achieve settlement finality and irrevocability, which occur once a payment has been accepted by the system (art. 11). A transfer order is defined as accepted once it has passed all risk controls established in the rules of the system and, therefore, can be settled according to the same rules. This same article also states that bankruptcy, insolvency, and other similar events shall not affect settlement finality. It is worth noting that settlement finality also covers securities transfers in light of art. 1 of the Law. Further, Mexican laws do not contain provisions on the so-called “zero-hour rule”. The provisions of the Payments System Law on settlement finality are further articulated in the SPEI rules (Circular No. 17/2010). SPEI rules define accepted payments as those that have been settled according to art. 5 of the regulations. Therefore, according to SPEI rules, a payment instruction is not final until after the participants’ accounts have been affected (debited or credited) and the notification of settlement has been sent to the participants. Art. 15 of the Payments System Law prevents the participants’ funds or collateral provided in a payment system from being seized until the daily participants’ obligations have been met. Credit institutions’ account at Banxico – whether in local currency or US dollars – cannot be embargoed. Netted positions are settled in SPEI, on average, every 1.9 seconds. The Payments System Law defines clearing as the process whereby – according to the rules of the system – the participants’ rights and obligations deriving from the payment orders are replaced by one debit or credit obligation, without the need for the participants’ explicit consent. The enforceability, including against third parties, of netting arrangement is ensured under Chapter II on irrevocability and validity of accepted payment orders and the resulting obligations, including clearing. Art. 259 of the Ley General de Títulos y Operaciones de Crédito (LGTOC) states that a repurchase (repo) operation entails the transfer of ownership of the underlying securities, and is perfected by the delivery of the same. Art. 266 of the LGTOC provides that if the party that initially transferred the securities (reportado) does not repurchase such securities – and the repo has not been renewed – the operation is considered abandoned, and

13

the counterparty holding the securities (reportador) may require that any difference in price be paid out. Repo operations between Banxico on the one hand and credit institutions and broker-dealers on the other hand are regulated in Circulars No. 3/2012 (Chapter III) and 115/2002. Art. 131 par. IV of Circular No. 3/2012 (Chapter III) limits the eligible assets to Federal Government bonds (BONDES), IPAB (Instituto para la Proteccion al Ahorro Bancario) securities, Federal Treasury certificates (CETES, with the exclusion of CETES ESPECIALES), Banxico Monetary Regulation Bonds (BREMS), and segregated coupons that belong to the financial institution. In case the counterpart does not repurchase the securities, art. 136 establishes that Banxico will (i) keep the securities if these mature on the following operating day or, (iii) automatically renew the repo for the next operating day up to a maximum number of days that Banxico will establish and communicate to the counterpart through the collateral management system, under the assumption that the reiterated renewal of repos is not considered a sound practice. In case of renewal, the regulation allows Banxico to charge a fee to be calculated according to the formula of the art. 137. Moreover, the renewal implies re-calculating the price based on the value of the collateral at close of business day, and will be applied against the participant’s credit limits of the next operating day. As laid out in Circular No. 115/2002, broker-dealers may celebrate repos with credit institutions using the funds that credit institutions have in turn obtained from repurchase operations with Banxico. The conditions of these repos shall be agreed upon by the parties, although its characteristics must be identical to those of the repo operations celebrated between Banxico as the repurchasee and the credit institution as the repurchaser. Banco de México’s Law, art. 14 establishes that the credit granted by Banxico to credit institutions may only be aimed at monetary policy, while art. 15 provides for an exception to this rule to avoid possible disruptions in the payments system. Central bank credit must be collateralized against the deposits that credit institutions hold at Banxico (art. 16). Art. 28 establishes that credit institution must constitute deposits at Banxico, known as depósitos de regulación monetaria. Overdrafts of the “cuenta única” are collateralized against these deposits, and also against other MXN and US dollar deposits. Collateralized overdrafts are regulated in art. 115 of Circular No. 3/2012.

Key consideration 2

An FMI should have rules, procedures, and contracts that are clear, understandable, and consistent with relevant laws and regulations.

Description Circular No. 17/2010 (SPEI Rules), the SPEI Operating Manual, and the contingency manual for operations with CLS Bank International (CLS) complete SPEI’s legal basis. The legal basis are clear and understandable. Participants’ rights and obligations have been clearly elaborated upon in three types of contracts with (i) banks, (ii) broker-dealers, and (iii) non-bank financial institutions. Regulations that have a bearing on SPEI operations are drafted in collaboration with and reviewed by various departments within Banxico. The legal department contributes to the design, adoption and subscription

14

of new regulations, thus reducing legal risks and enhancing compliance with the applicable federal laws. In developing SPEI’s legal basis, Banxico did not avail itself of external legal opinions (see KC 1.4). Finally, as per the Banxico’s delegation of authority (Acuerdo de Adscripción de las Unidades Administrativas del Banco de México), payment system regulations are subscribed by the relevant administrative units. Throughout the process of issuing new regulations / amending existing regulation, Banxico maintains an open channel of communication with the participants. This process may also involve ad-hoc meetings with the participants. Although informal consultations are contemplated as a general practice, there is no explicit requirement that new regulations or amendments that might materially impact the participants be placed in public consultation before final approval and entry into force.

Key consideration 3 An FMI should be able to articulate the legal basis for its activities to relevant authorities, participants, and, where relevant, participants’ customers, in a clear and understandable way.

Description In practice, proposed changes to key internal rules, procedures and requirements are consulted with participants. However, a requirement that these consultations be made is not established in SPEI Rules, Operating Manual or elsewhere. Any actual changes to internal regulations are communicated to participants and posted on the SPEI online collaboration site. SPEI Rules are publicly available on the Banxico website; any modifications to SPEI Rules are made available through the Official Gazette of the Federation and through Banxico’s website. Manuals are provided to participants upon joining the system and to other parties with a legitimate interest.

Key consideration 4 An FMI should have rules, procedures, and contracts that are enforceable in all relevant jurisdictions. There should be a high degree of certainty that actions taken by the FMI under such rules and procedures will not be voided, reversed, or subject to stays.

Description Enforceability of rules, procedures and contracts The only relevant jurisdiction for SPEI is Mexico. All Mexican financial regulations, including those regulations having a bearing on SPEI operations are federal in nature thus ensuring that all participants regardless of their location abide by the same laws. There is no precedence of a SPEI rule of procedure being subject to judicial controversy and/or revoked by any other competent authority. Banxico has the exclusive power to issue regulations applicable to the SPEI.

15

Degree of certainty for rules and procedures SPEI rules and procedures are framed under the current legal framework of the country, particularly the Banco de México’s Law, and the Payments System Law – thus ensuring a high degree of certainty.

Key consideration 5 An FMI conducting business in multiple jurisdictions should identify and mitigate the risks arising from any potential conflict of laws across jurisdictions.

Description The only relevant jurisdiction for SPEI is Mexico. Key conclusions SPEI legal basis are comprised of the Banco de México’s Law and the

Payments Systems Law, and provide a high degree of certainty for each material aspects of SPEI operations, which include: (i) finality and irrevocability of payments, (ii) netting (SPEI being a hybrid system), and (iii) enforceability of securities interests provided under repo agreements. Circular No. 17/2010 (SPEI Rules), the Operating Manual, and the Contingency Manual for Operations with CLS Bank International (CLS) complete SPEI’s legal basis. The legal basis are clear, understandable, and consistent with the underlying legal framework. Participants’ rights and obligations have been set in contracts. The only relevant jurisdiction for the SPEI is Mexico. All Mexican financial regulations, including those having a bearing on SPEI’s operations are federal in nature.

Assessment of Principle 1

Observed

Recommendations and Comments

Although informal consultations are contemplated as a general practice, there is no explicit requirement that new regulations or amendments that might materially impact the participants be placed in public consultation before final approval and entry into force. The creation of a Users’ Committee or similar mechanism (see Principles 2 and 21) should be used as a platform for formal consultations.

16

PRINCIPLE 2: GOVERNANCE An FMI should have governance arrangements that are clear and transparent, promote the safety and efficiency of the FMI, and support the stability of the broader financial system, other relevant public interest considerations, and the objectives of relevant stakeholders. Key consideration 1 An FMI should have objectives that place a high priority on the safety

and efficiency of the FMI and explicitly support financial stability and other relevant public interest considerations

Description The Banco de México’s Law, art. 2 establishes as Banxico’s priority the stability of the purchasing power of the currency. For these purposes, Banxico shall promote the healthy development of the financial system and the smooth operation of the payments system. Art. 3 entrusts Banxico with the regulation of payment systems. The main objective of the Payments Systems Law is to facilitate the smooth functioning of the payments system (art. 1) through finality and irrevocability of funds and securities transfers. SPEI Rules reiterate the objective of continuing to facilitate the smooth functioning of the payments system; in addition, enhance transparency through the inclusion of consumer protection measures. Finally, Banxico’s draft policy document on FMIs (Politicas y funciones del Banco de México respecto a las infraestructuras de los mercados financieros) lays out Banxico’s objectives with regard to each of the FMIs; in particular, SPEI’s overall objective is to settle participants’ transfer orders in a timely, efficient, and safe manner, and at a low cost, taking into account the needs of both financial markets and retail payments. To achieve this overall objective SPEI (i) will process payments on a near-real time basis; (ii) will not generate credit or liquidity risks; (iii) will provide high service levels to its participants and users through business continuity measures and adequate risk management; (iv) facilitate participants’ provision of payment services and information to their customers. The draft policy emphasizes the public good aspect of payment services which, in order to benefit society, must be convenient, fast, and cost-efficient. Banxico makes an explicit commitment towards (i) accountability – as a way to report on how it discharges its responsibility for the smooth functioning of the payments system; (ii) public disclosure to enhance customers’ confidence in the payment services and; (iii) transparency to facilitate FMIs’ and their participants’ own risk management and compliance. At the institution’s level, medium-term objectives (objetivos institucionales) over a five-year horizon are identified under a number of guiding principles (ejes rectores). Out of nine such principles which comprise 36 objectives, at least six and have some degree of relevance to SPEI / payment systems. In particular, principle 5 seeks to “foster the use of electronic payments, by promoting a regulatory framework that boosts

17

efficiency and competition”, and principle 7 aims to “strengthen the internal control system, risk management, and physical and information security of the Bank”. Annual work plans are presented by the heads of the administrative units to the Governor which are aligned with the institution’s medium-term objectives and set out the goals, targets and the necessary budgetary resources to carry them out. Progress is periodically assessed by the senior management and reported to the Governor at least once a year. The Board of Governors is informed of the system’s performance against set targets.

Key consideration 2 An FMI should have documented governance arrangements that provide clear and direct lines of responsibility and accountability. These arrangements should be disclosed to owners, relevant authorities, participants, and, at a more general level, the public.

Description

Governance arrangements SPEI governance arrangements derive from Banxico’s Internal Regulations supported by the Banco de México’s Law. Central bank functions and its administration are entrusted to a Board of Governors and a Governor (art. 38 of the Banco de México’s Law). The Board is comprised of five members. The executive power nominates the Governor who chairs the Board, whereas the remaining Board members are Deputy Governors. The Board of Governors and Governor may establish committees of advisory or decision-making nature. The Audit Committee advises the Board on auditing issues. Its responsibilities are detailed in art. 29 Bis 2 of Banxico’s Internal Regulations. The Audit Committee is comprised of two members of the Board (other than the Governor and the Deputy Governor who chair the Comisión de Responsabilidades) and an independent member designated by the Board. The Governor (art. 47) is tasked with the administration of the Bank, its legal representation, and the exercise of its functions. For the purposes of discharging the responsibilities that the Law attributes to the Governor, the latter counts with the General Directorates and Directorates (see art. 4 of Banxico’s internal regulation). Art. 8 of Banxico’s Internal Regulations in combination with the Administrative Units Ascription Agreement determine the lines of responsibility within Banxico. The ascription of powers to the Directorates General and Directorates implies subscribing all acts that are directly linked to the exercise of these powers, concluding agreements, requesting, providing and publishing information, and collaborating with whomever the administrative units deem appropriate in order to discharge their responsibilities. In 2008, the Operational Continuity Committee was created with the objective of supporting the Governor in coordinating Banxico’s efforts to establish and maintain a culture of risk management and ensure business continuity in situations of contingency. Its tasks include: (i) approving the list of critical processes – being SPEI one of them – as well as the

18

corresponding support processes; (ii) providing opinions on the criteria, reports, and other issues as determined by the Payment Systems Directorate (Dirección de Sistemas de Pagos, DSP) in relation to operational continuity, and; (iii) act as an advisory body to Governor on operational continuity. The Committee is chaired by the Governor and comprises the Director General of Comptroller and Risk Management. The Security Committee and the Committee on Information Technology are also relevant to SPEI operations. The attributions of the Directorate of Payment Systems are detailed in Banxico’s Internal Regulation (art. 20). These include a number of tasks that have a direct bearing on SPEI operations, e.g.:

(i) In coordination with the Directorate General of Operations, design, prepare and implement the policies for the daily provision of liquidity to the payment systems and their participants

(ii) Develop and maintain the systems administrated by Banxico, as well as other systems that are necessary for their proper functioning

(iii) Manage and operate central bank systems and provide advisory and support services to the participants

(iv) Implement and monitor the proper functioning of the payment systems administered by Banxico

(v) Coordinate, implement, and monitor participants’ operations in the payment systems administered by Banxico

(vi) Handle the charges for the use of central bank-administered systems

(vii) Establish the business continuity policies In turn, the Payment System Directorate is articulated in Divisions and Subdivisions. Disclosure of governance arrangements The Banco de México’s Law (http://www.banxico.org.mx/disposiciones/marco-juridico/ley-del-banco-de-mexico/%7B74481036-5967-73EE-18B1-602D30C646E2%7D.pdf) and its internal regulations are publicly available (in Spanish) ( (http://www.banxico.org.mx/disposiciones/marco-juridico/reglamento-interior/%7B09CEAF1B-897B-85B8-833F-959C4E620B5D%7D.pdf) Also publicly available is the Administrative Unit Adscription Agreement (http://www.banxico.org.mx/disposiciones/marco-juridico/acuerdo-de-adscripcion/%7BEF690DCC-7264-9A22-B91A-FE97454604D3%7D.pdf). Banxico’s organizational structure is available on its website (http://www.banxico.org.mx/acerca-del-banco-de-mexico/organizational-structure.html) The disclosure of Banxico’s legal framework, organizational structure, responsibilities of each area, objectives and targets – among other aspects of Banxico’s operations – is a requirement under art. 70 of the General

http://www.banxico.org.mx/acerca-del-banco-de-mexico/organizational-structure.html

http://www.banxico.org.mx/acerca-del-banco-de-mexico/organizational-structure.html

19

Law on Transparency and Access to Public Information. (http://www.banxico.org.mx/ley-de-transparencia/informacion-que-publica-el-banco-de-mexico-en-cump/informacion-que-publica-banco.html)

Key consideration 3 The roles and responsibilities of an FMI’s board of directors (or equivalent) should be clearly specified, and there should be documented procedures for its functioning, including procedures to identify, address, and manage member conflicts of interest. The board should review both its overall performance and the performance of its individual board members regularly.

Description

The roles and responsibilities of Banxico’s Board of Governors are set forth in art. 46 of the Banco of Mexico’s Law and are further elaborated in Banxico’s Internal Regulations. The Board is responsible for determining the policies and criteria that inform Banxico’s operations, and determines which policies based on their importance warrant prior approval. The Banco of Mexico’s Law specifies the incompatibilities of Board members (arts 39, 42, 43, 60). Review of performance There is no review of Board’s performance as such. The removal of a Board member is decided by simple majority voting of the Board upon request of the President of the Republic or at least two Board members. On the other hand, there exist certain accountability requirements. First, the Governor shall appear each year before the Senate of the Republic to report on the discharge of his/her mandate (art. 47). Second, any of the two Chambers of the Congress of the Union may summon the Governor to account for the Bank’s policies and activities (art. 52). The Federal Law on the Responsibilities of Public Servants is deemed applicable to the members of the Board of Governors.

Key consideration 4 The board should contain suitable members with the appropriate skills and incentives to fulfill its multiple roles. This typically requires the inclusion of non-executive board member(s).

Description

Board members are designated according to the Constitution (Constitución Política de los Estados Unidos Mexicanos, art. 28). The latter specifies that Board members: (i) shall perform their duties over periods of time whose duration and staggering ensure the independent discharge of their responsibilities; (ii) can only be removed for serious cause, and; (iii) may not have other occupations or responsibilities with the exception of those in representation of the Bank or related to educational, scientific, cultural and charitable associations as long as non-remunerated. Board members must enjoy well-established reputation for monetary matters and have occupied high-level positions in the Mexican financial system for a minimum of five years. While for two out of five members it

http://www.banxico.org.mx/ley-de-transparencia/informacion-que-publica-el-banco-de-mexico-en-cump/informacion-que-publica-banco.html



20

is not mandatory to comply with these requirements, all Board members must be distinguished professionals in economic, financial or legal matters. The Governor’s and Deputy Governor’s offices have a duration of six and eight years, respectively. Board members may be re-nominated. The remuneration of the Governor and the Deputy Governors is determined by a committee comprised of the President of the CNBV and by two additional individuals nominated by the SHCP. In determining the remunerations, the committee takes into consideration the existing practices within Banxico and in the Mexican financial sector with the objective to ensure that the Board includes adequate members and the Bank is in a position to attract and retain qualified personnel.

Key consideration 5 The roles and responsibilities of management should be clearly specified. An FMI’s management should have the appropriate experience, a mix of skills, and the integrity necessary to discharge their responsibilities for the operation and risk management of the FMI.

Description

Roles and responsibilities of management The roles and responsibilities of the senior managers are stated in the Internal Regulations and in the profiles of the management positions. The objectives, roles and responsibilities, and deliverables of the Director of the Payment System Directorate are clearly defined. However, the responsibilities as far as risk management in concerned are not clearly documented. Annual review of performance of Banxico’s personnel is carried on the basis of internal regulations on performance management. Senior managers’ annual evaluation on the other hand is carried out according to the criteria set by the Governor. Experience, skills and integrity Banxico’s recruitment policies are rigorous in that candidates must meet a set of pre-determined criteria established in the job profiles. This process involves the assessment of technical and managerial abilities. Banxico’s personnel is subject to regular assessment of their competencies based on internal regulations on competence management. The application of a standardized methodology allows determining the degree of alignment of the personnel’s competences to their respective job profiles. These evaluations support the administration of human resources. To ensure that its employees have the necessary integrity to fulfill their roles, Banxico has issued a number of internal regulations and manuals and established certain enforcement mechanisms, e.g.:

21

• The Institutional Ethics Code establishes the ethical principles by which Banxico’s employees must abide, and the obligations regarding their conduct in the performance of their duties.

• The General Labor Conditions of the Bank of Mexico defines the rights and obligations of Banxico’s employees.

• Banxico keeps a registry of public officers in accordance with the Federal Law of Administrative Liabilities of Public Officers.

• The Liabilities Committee is the organ of Banxico charged with the application of the Federal Law of Administrative Liabilities of Public Officers. It determines the administrative liabilities of the public officers and, where appropriate, imposes penalties. On the other hand, for senior management the Board itself determines the penalties based on information provided by the Committee.

Key consideration 6 The board should establish a clear, documented risk-management framework) that includes the FMI’s risk-tolerance policy, assigns responsibilities and accountability for risk decisions, and addresses decision making in crises and emergencies. Governance arrangements should ensure that the risk-management and internal control functions have sufficient authority, independence, resources, and access to the board.

Description

Risk management framework Art. 46, par. V of the Banco of Mexico’s Law entrusts the Board with the definition of the policies and criteria under which the Bank undertakes its operations. The Law provides that, certain policies are submitted to the Board for approval depending on their importance as determined by the Board itself. Banxico has developed an Internal Control System based on international best practices such as the Committee of Sponsoring Organizations of the Treadway Commission (COSO) guidance. The Internal Control System is defined as the organization and set of activities, regulations, policies, standards and procedures in order to provide a reasonable level of security with respect to certain institutional objectives. It is comprised of five components: control environment, risk assessment, control activities, information and communication, and supervision. Each of Banxico’s administrative units is responsible for the implementation of these activities within their area of competence. Process owners are tasked with the identification and administration of the risks inherent to the processes they manage, whereas the Directorate General of Comptroller and Risk Management provides the overall criteria and methodologies. Operational risk is defined as risk caused by human error, organizational or other factors related to equipment and information. The Internal Control System framework is documented in Banxico’s internal regulations. As regards SPEI, the Payment System Directorate (Dirección de Sistemas de Pagos, DSP) and the General Directorate of Information Technology (Dirección General de Tecnologías de la Información, DGTI) are the areas more directly involved in the operation of the system as established in the

22

Banxico’s Internal Regulations. In this context, the DSP has established a comprehensive risk management framework for SPEI. The levels of risk tolerance are established based on risk evaluation by impact and frequency of occurrence. The identified risks are mapped to twelve quadrants in a risk map. Accepted risks belong to two categories: (i) risks for which sufficient controls are in place such that the frequency of occurrence is considered very low (note, a risk without preventive controls cannot fall within this category). Risks mapped from low to moderate impact and low to high frequency of occurrence will be addressed subject to there being sufficient available resources. Finally, risks that have a moderate to critical impact and low to high frequency are marked as red in the risk map, which imply taking immediate action to implement controls and obtaining the resources should these not be readily available. It is understood that the risk map is updated annually or more frequently in the context of the update of the SPEI risk management framework. Banxico Internal Regulations address risk management responsibilities. In particular, the Risk Management Directorate is responsible for the identification of relevant risks incurred by the Bank, and for proposing criteria, parameters and methods for determining the amount of exposure to such risks, as well as for risk monitoring. Within its responsibilities, the DSP is tasked with the design, development and implementation of policies for the overall development and smooth operation of payment systems, and establishes the business continuity policies. It is worth noting that risk management is one of the guiding principles that comprise Banxico’s institutional plan, namely Guiding Principle 7 – “Strengthen the internal control system, risk management, security, and physical and information security of the Bank”. Enhancing the operational reliability and business continuity of the payment system is an objective within Guiding Principle 7. The plans and achievement in meeting this objective are regularly reported to the Board. Authority and independence of risk management and audit functions Banxico has an Audit Committee that advises the Board on auditing issues. It is responsible for clearing the annual program of audits proposed by Director of Audit prior to Board’s approval, and follow up on the implementation of the recommendations of internal and external audit. The Director of Audit and the Director General of Risk Management are permanent invitees to the Committee (with voice but no vote). The Audit Committee cannot include the Governor and comprises an external member. In 2015, the DSP was subject to four internal audits (and two external audits).

Key consideration 7 The board should ensure that the FMI’s design, rules, overall strategy, and major decisions reflect appropriately the legitimate interests of its

23

direct and indirect participants and other relevant stakeholders. Major decisions should be clearly disclosed to relevant stakeholders and, where there is a broad market impact, the public.

Description

Identification and consideration of stakeholder interests In practice, new regulations or amendments to existing regulations that have a bearing on SPEI operations are notified in advance to the interested parties. It is understood that, depending on the class of participants that would be affected by the changes, Banxico holds meeting / ad hoc consultations with the relevant participants. However, there is no formal mechanism or requirement that formal consultations with the participants are held. In this regard, consultations are mostly held with the association of banks. The Governor and Board of Governors hold meetings with the financial institutions in which issues relating to SPEI may also be raised. Banxico has implemented a help desk (Centro de Atención de los Sistemas de Pagos, CASP) for system users and undertakes surveys that provide important inputs in the overall development strategy of the system. Disclosure There are multiple internal and external channels of communication of major decisions, which include announcing and posting new regulations/amendments in the internal collaboration site, and circular letter, publication in the Official Gazette if appropriate (e.g. for modifications to SPEI rules), and on the Banxico’s website.

Key conclusions Banxico has an explicit commitment towards the safety and efficiency of the payment system as a whole. This is laid down in article 2 of the Banco de Mexico’s Law, and is supported in SPEI’s legal basis, as well as in Banxico’s draft policy on FMIs. Furthermore, Banxico’s institutional work plan emphasizes payment systems’ operational risk management among other objectives. SPEI’s performance with regard to this objective is measured through system availability and recovery time, and is reported to the Board of Governors regularly. SPEI’s governance derives from Banxico Internal Regulations and the Administrative Units Ascription Agreement whereby the Directorate General of Payment Systems and Corporate Services is entrusted with the administration of SPEI through the DSP. Banxico’s Board of Governors has broad powers to decide upon internal policies as appropriate, including any material decisions related to SPEI risk management. Banxico has established an internal control system which is applied to DSP processes including SPEI under the oversight and overall guidance of the Directorate General of Comptroller and Risk Management. The latter has a reporting line to the Governor. The internal audit department audits the operation of SPEI and reports directly to the

24

Board of Governors. Furthermore, the Board has established an Audit Committee. When Banxico makes changes to SPEI that have an impact on participants, it informs them prior to implementing the changes. However, there is no obligation to collect participants’ opinions, nor did Banxico establish a formal mechanism for consultations. Depending on the nature of document, Banxico’s major decisions on SPEI may be disseminated through a range of restricted access or publicly available tools.


Broadly Observed

Recommendations and comments

Currently, notification / consultation practices rely on informal mechanisms. In consideration of the wide subscription of SPEI services by a diverse set of financial institutions, it is recommended that Banxico establish a Users’ Group or other formal mechanism to facilitate stakeholders’ access and inputs to SPEI decision-making on an equal footing (see also Principles 18 and 21). It is understood that Banxico is in the process of developing terms of reference (TORs) for the participants’ forum. While the audit function has a direct reporting line to the Board of Governors, this is not the case for risk management. In light of the emphasis that the PFMI place on risk management governance (KC 7), and without prejudice to the Board’s and Governor’s roles and responsibilities3, it is recommended that SPEI risk management policy including risk-tolerance be endorsed by the Board of Governors.

3 See CPMI, “Application of the Principles for financial market infrastructures to central bank FMIs”, August 2015.

25

PRINCIPLE 3: FRAMEWORK FOR THE COMPREHENSIVE MANAGEMENT OF RISKS An FMI should have a sound risk-management framework for comprehensively managing legal, credit, liquidity, operational, and other risks. Key consideration 1 An FMI should have risk-management policies, procedures, and

systems that enable it to identify, measure, monitor, and manage the range of risks that arise in or are borne by the FMI. Risk-management frameworks should be subject to periodic review.

Description Risks that arise in or are borne by the FMI The SPEI risk management framework has identified the following risks that arise in or are borne by SPEI:

(a) operational risk. It is indicated as the most relevant category of risk applicable to SPEI, given that its materialization would cause the greatest impact on the system. It is categorized into system-related (software and hardware), process-related, human, and external.

(b) legal risk. It arises from the unexpected application of laws or regulations, e.g. if SPEI regulations are not fully aligned with federal laws and the provisions of other authorities, or in case of disputes.

(c) business risk. Being SPEI a central bank-operated system, business risk would only materialize if its operating costs were underestimated, e.g. as a result of the omission of cost factors or due to an unexpected increase in expenses.

(d) custody and investment risk. It arises only with regard to the custody of participants’ securities in DALI which are used as collateral in repo operations with Banxico. In this regard, custody risk would only be applicable under a “broader” approach to risk management in Banxico as opposed to SPEI strictly speaking (see above).

In addition:

(a) SPEI is not considered exposed to credit risk to the extent that the system as such does not provide credit to the participants, nor participants face credit exposures vis-à-vis each other in SPEI. However, it is recognized that Banxico is exposed to credit losses as a result of intraday liquidity provisions in the form collateralized repos for banks and broker-dealers through RSP. On the other hand, collateralized overdrafts are not deemed as a source of credit risk.

(b) liquidy risk is not deemed applicable to SPEI given its design similar to a RTGS system, and that participants’ payment order are processed only if there are sufficient funds in their settlement accounts. However, it is recognized that participants may be exposed to liquidity pressures as a result of mutual payment obligations they incur in the system. To mitigate liquidity risk, Banxico provides intraday liquidity in the form of collateralized overdrafts and repos.

Risk management policies, procedures and systems

26

The DSP risk management policy is comprised of the following elements: 1. Identification and evaluation of risks. It consists of: (i) mapping of

the processes to identify critical processes and the control points; (ii) self-assessment of the risks and controls undertaken by the DSP; (iii) incident data collection and analysis, and; (iv) internal and external audit. Through the application of these tools, risks are identified and evaluated on the basis of the frequency of their occurrence (i.e. the frequency with which a risk may materialize in a given period) and the impact (i.e. how the risk would affect the system if it materialized). For the frequency, a period of two years prior to the measurement is considered, whereby 4 or more events in the last two years would lead to qualifying the risk as having a high frequency of occurrence. In order to evaluate the impact of the risks, the DSP conducts a business impact analysis (BIA).4

2. Risk control and mitigation. The DSP and the Dirección General de Tecnologías de la Información (DGTI) seek to reduce the frequency of occurrence through preventive controls including policies, procedures, and manuals, or the impact through corrective controls such as alerts. Once the controls have been applied, the risks are evaluated again. If controls are in place that prevent a certain risk from occurring, and there has been less than one incident in the past two years, the risk’s frequency of occurrence would be rated as “very low”.

3. Risk tolerance policy. Based on the outcomes of the risk evaluation after applying the controls and mitigation measures, the identified risks are placed in a risk map. The risks with very low levels of frequency (which have preventive controls in place) and those with low to moderate impact combined with low to high frequency belong in the green zone of the risk map, i.e. are accepted. Risks with critical impact or moderate impact but high frequency are flagged for immediate action.

4. Monitoring. The DSP carries out an annual evaluation of the controls to validate their consistency with the risk tolerance criteria.

5. Frequency of application. Should a new risk be identified, this is qualified and registered in the risk map. The necessary controls are applied consistently with the risk tolerance policy.

Review of risk management policies, procedures and systems In addition to points 4 and 5 above, the comprehensive risk management policy is reviewed annually or when one of the following events occur: (i) significant change in the system or the underlying infrastructure; (ii) a change in the regulatory framework; (iii) a change in the organizational structure.

4 Impact evaluation is based on (i) DSP systems’ response time, i.e. the number of minutes it takes DSP to resume critical services after a disruptive event, and (ii) the time of the day when the disruptive event might occur, under the assumption that a disruption during peak times would have a more critical impact. The BIA also takes into account a number of “non-quantifiable” risks, such as a system-wide lack of liquidity or a loss of confidence of the systems’ users due to a delay in the crediting of the funds.

27

Key consideration 2 An FMI should provide incentives to participants and, where relevant, their customers to manage and contain the risks they pose to the FMI.

Description Each participant of the system has at its disposal comprehensive information and a range of tools to manage the risks it poses to the system. At any time during operating hours, participants are able to monitor their real-time balances, credit and debit transactions performed throughout the day and their queued payments. Participants can set priority payments, and reserve balances for priority payments. Participants must undergo a process of certification aimed to ensure that financial institutions have the necessary operational requirements to operate safely in the system. Once the certification has been obtained, participants must keep Banxico informed of any changes incurred in their infrastructure that may warrant a re-certification. Participants’ information security and operational risk requirements are inspected by Banxico. In addition, Banxico can suspend or revoke participants when they pose a risk to the system or in case of breach of SPEI rules or contract (see SPEI rules, art. 11.9). Participants who do not comply with the terms of the contract also incur in penalty fees as specified in the contracts.

Key consideration 3 An FMI should regularly review the material risks it bears from and poses to other entities (such as other FMIs, settlement banks, liquidity providers, and service providers) as a result of interdependencies and develop appropriate risk-management tools to address these risks.

Description Material risks Banxico through SPEI does not undertake any credit or liquidity risk as a result of allowing other systems to settle in central bank money. DALI is the only FMI that settles through SPEI. Nevertheless, if DALI were to face problems to complete settlement, this could stress liquidity conditions in SPEI. Intraday liquidity through the RSP system could also be reduced as a result of a disruption in DALI. The DSP has identified the interdependencies of its main services with other entities (intermediaries, services, and applications/systems) as well as their critical nature and the processes involved. In particular, with regard to SPEI:

i. SPEI’s inability to effect real-time transfers is considered to have a high impact on both SPEI/DALI participants and SIAC. CLS processes would also be impacted, although to a lesser extent.

ii. Provision of intraday liquidity by means of collateralized overdrafts from SIAC has a bearing on transfers from SIAC to SPEI and vice versa, whereas a disruption in the RSP system for repo operations is not deemed relevant to SPEI processes (although it is considered very relevant to DALI operations)

iii. . iv. Other DSP-managed systems, e.g. SPID, do not have a bearing on

SPEI processes.

28

SPEI business continuity plan also contemplate external risk factors, i.e. the risks that arise from participants, entities external to the DSP, and other types of external events (e.g. natural disasters). Risk management tools From an operational risk perspective, the DSP has taken a DSP-wide approach to risk evaluation (e.g. BIA) and risk management (through the DSP operational continuity management system and business continuity plan) that includes interdependencies between the various DSP-operated systems. To the extent that DALI is a direct participant in SPEI, the operational risks posed and borne by this FMI are mitigated through the participants’ alternate operating procedure (Cliente de Operación Alterno del SPEI, COAS) and through more stringent risk-based requirements. At the level of critical third-party service providers, Banxico’s policy is to have redundancy with different providers whenever possible. In all cases, minimum service level agreements (SLAs) are established in contracts.

Key consideration 4 An FMI should identify scenarios that may potentially prevent it from being able to provide its critical operations and services as a going concern and assess the effectiveness of a full range of options for recovery or orderly wind-down. An FMI should prepare appropriate plans for its recovery or orderly wind-down based on the results of that assessment. Where applicable, an FMI should also provide relevant authorities with the information needed for purposes of resolution planning.

Description Scenarios that may prevent an FMI from providing critical operations and services Banxico does not foresee a scenario, other than the materialization of a major operational risk, where it could be prevented from being able to provide its critical operations and services as a going concern. However, it periodically identifies and evaluates the risks that could materially affect its ability to provide SPEI services as expected. In this context, it has put in place the necessary preventive and corrective controls to minimize the impact of these risks on the availability and service levels of SPEI. Recovery or orderly wind-down plans Not applicable

Key conclusions The framework for management of risks in SPEI is stipulated in the “Framework for the Comprehensive Management of Risks applicable to SPEI”. This document enables the identification and periodic evaluation of risks, and of the controls that have been put in place to manage these risks. Risk management relies on preventive control measures including policies, procedures, and manuals. Banxico carries out an annual evaluation of the controls to validate their consistency with the risk tolerance policy. The

29

overall framework is scheduled to be reviewed once a year or more frequently (the first revision is due by March 2017). The scope of SPEI’s risk management framework includes the risks that arise in the system, those that derive from interdependencies with other systems, as well as those posed by the participants to the system. From an operational perspective, the risks from interdependencies with SIAC and DALI are managed through the DSP-wide operational continuity management system and business continuity plan, and the participants’ certification and alternate operating procedures (Cliente de Operación Alterno del SPEI, COAS), respectively. SPEI provides its participants with the tools for them to manage appropriately their risks. Negative incentives in the form of penalties to the suspension and termination are provided in the SPEI Rules and contracts.


Broadly Observed


The risk management framework concludes that credit and liquidity risks are not applicable. Although SPEI as such does not undertake credit or liquidity risks, it is worth noting that:

- The PFMI acknowledge that credit risk in payment systems is mainly driven by current exposures from extending intraday credit to the participants (PFMI 3.4.2).

- Liquidity risk is defined as the risk that arises when the FMI, its participants, or other entities cannot settlement their payment obligations when due (PFMI 3.7.1).

- In light of the above, the assessor has considered intraday repos both as a source of credit risk for Banxico within Principle 4 and as a tool to help manage participants’ liquidity risk within the assessment of Principle 7.

Financial risks to the extent relevant should be embedded in SPEI’s risk management framework. For example, RSP limits, collateral valuation practices, and haircut methodology are the relevant risk management measures of Banxico’s exposures to credit risk as a result of providing intraday repos to SPEI’s participants (see Principle 5). These measure should be integrated in / coordinated with the broader risk management framework.

30

PRINCIPLE 4. CREDIT RISK An FMI should effectively measure, monitor, and manage its credit exposure to participants and those arising from its payment, clearing, and settlement processes. An FMI should maintain sufficient financial resources to cover its credit exposure to each participant fully with a high degree of confidence. In addition, a CCP that is involved in activities with a more-complex risk profile or that is systemically important in multiple jurisdictions should maintain additional financial resources sufficient to cover a wide range of potential stress scenarios that should include, but not be limited to, the default of the two largest participants and their affiliates that would potentially cause the largest aggregate credit exposures to the CCP in extreme but plausible market conditions. All other CCPs should maintain, at a minimum, total financial resources sufficient to cover the default of the one participant and its affiliates that would potentially cause the largest aggregate credit exposures to the CCP in extreme but plausible market conditions. Key consideration 1 An FMI should establish a robust framework to manage its credit

exposures to its participants and the credit risks arising from its payment, clearing, and settlement processes. Credit exposure may arise from current exposures, potential future exposures, or both.

Description SPEI uses a multilateral offsetting algorithm running in quick successions (every 1.9 seconds on average) to clear and settle transactions in a topology chosen by the initiating participant. The algorithm selects those transactions that can be settled based on available balances in the participants’ settlement accounts and clears and settles in batch mode. Although this process may overdraw some accounts for a fraction of a second, the complete process does not generate overdrafts. The transactions that cannot be settled remain in the queue. Transactions that cannot be settled by close of business day are cancelled. As a result of this process, participants do not incur in credit risk as such. Moreover, SPEI accounts cannot be over-drafted. Participants fund their operations in SPEI through incoming payments and by means of transfers from the SIAC accounts. The system settles the payments upon verifying that the originating participants have sufficient funds in their accounts. Payments that cannot be settled due to insufficient funds are queued until funds become available. Payments that cannot be settled by the end of the operating day are cancelled. At system’s closures all SPEI balances (if any) are returned to the SIAC accounts or to a concentration account that does not accrue interest (in the case of non-bank participants that do not have an account in SIAC). Banxico does allow banks to overdraft their SIAC current accounts but it does not bear any credit risk from this mechanism, being overdrafts fully collateralized with cash at the central bank (depósitos de regulación monetaria). In addition to current account overdrafts, Banxico provides intraday liquidity through repos to banks and to broker-dealers through banks. The liquidity is credited directly to the cash accounts of the participants in DALÍ, from where it can flow to SPEI as needed. In this context, Banxico has a residual credit exposure which it mitigates by applying conservative haircuts and by limiting the assets it accepts as collateral to those with low credit, liquidity, and market risk. In addition, there are limits to repo

31

operations with Banxico, which are automatically enforced in the RSP system.

Key consideration 2 An FMI should identify sources of credit risk, routinely measure and monitor credit exposures, and use appropriate risk-management tools to control these risks.

Description Through the RSP system, Banxico monitors and measures the credit exposures arising from repos in real time. Intraday credit limits are updated on a monthly basis and enforced automatically in the RSP system. In addition, banks must inform the maximum limits that they intend to apply to each broker-dealer. The sum of the limits granted by banks to a broker-dealer, and the total amount of repos that a broker-dealer is allowed to negotiate is capped at five times the total capital of the broker-dealer. Banxico requires that repos must be redeemed by close of business day of DALI at 16:15, although it facilitates an additional window through SIAC till 18:30. Securities eligible for the repo transactions are strictly limited to Federal Government bonds (BONDES), IPAB (Instituto para la Protección al Ahorro Bancario) securities, Federal Treasury certificates (CEDES, with the exclusion of CETES ESPECIALES), Banco de México’s Monetary Regulation Bonds (BREMS), and segregated coupons that belong to the financial institution. In addition, Banxico has established stable and conservative haircuts taking into consideration price fluctuations over a period of 10+ years (see Principle 5). Chapter III of Circular No. 3/2012 provides the details of intra-day repo transactions. The details include: (i) types of eligible securities (art. 131); (ii) method of availing intraday repo support through the RSP system (art. 133); (iii) limits to intraday repos (art. 134 based on the methodology of Annex 9); (iv) cancellation or rollover of the repo in the event of non-repurchase the securities (art. 136) and applicable penalties (art. 137); (v) repos between banks and broker-dealers with funds from repos with Banxico (Cap. III, Section II); (vi) limits for banks to engage in repos with broker-dealers, (art. 139 based on the methodology of Annex 9), and for broker-dealers (art. 141), and; (vi) cancellation of the repo in the event the broker-dealer does not repurchase the securities from the bank (art. 144).

Key consideration 3 A payment system or SSS should cover its current and, where they exist, potential future exposures to each participant fully with a high degree of confidence using collateral and other equivalent financial resources (see Principle 5 on collateral). In the case of a DNS payment system or DNS SSS in which there is no settlement guarantee but where its participants face credit exposures arising from its payment, clearing, and settlement processes, such an FMI should maintain, at a minimum, sufficient resources to cover the exposures of the two participants and their affiliates that would create the largest aggregate credit exposure in the system.

32

Description Since SPEI processes fund transfers based on a multilateral offsetting algorithm running in quick successions (every 1.9 seconds on average), in practice there is no credit risk involved.

Key consideration 4 A CCP should cover its current and potential future exposures to each participant fully with a high degree of confidence using margin and other prefunded financial resources (see Principle 5 on collateral and Principle 6 on margin). In addition, a CCP that is involved in activities with a more-complex risk profile or that is systemically important in multiple jurisdictions should maintain additional financial resources to cover a wide range of potential stress scenarios that should include, but not be limited to, the default of the two participants and their affiliates that would potentially cause the largest aggregate credit exposure for the CCP in extreme but plausible market conditions. All other CCPs should maintain additional financial resources sufficient to cover a wide range of potential stress scenarios that should include, but not be limited to, the default of the participant and its affiliates that would potentially cause the largest aggregate credit exposure for the CCP in extreme but plausible market conditions. In all cases, a CCP should document its supporting rationale for, and should have appropriate governance arrangements relating to, the amount of total financial resources it maintains.

Description Not applicable

Key consideration 5 A CCP should determine the amount and regularly test the sufficiency of its total financial resources available in the event of a default or multiple defaults in extreme but plausible market conditions through rigorous stress testing. A CCP should have clear procedures to report the results of its stress tests to appropriate decision makers at the CCP and to use these results to evaluate the adequacy of and adjust its total financial resources. Stress tests should be performed daily using standard and predetermined parameters and assumptions. On at least a monthly basis, a CCP should perform a comprehensive and thorough analysis of stress testing scenarios, models, and underlying parameters and assumptions used to ensure they are appropriate for determining the CCP’s required level of default protection in light of current and evolving market conditions. A CCP should perform this analysis of stress testing more frequently when the products cleared or markets served display high volatility, become less liquid, or when the size or concentration of positions held by a CCP’s participants increases significantly. A full validation of a CCP’s risk-management model should be performed at least annually.


Key consideration 6 In conducting stress testing, a CCP should consider the effect of a wide range of relevant stress scenarios in terms of both defaulters’ positions and possible price changes in liquidation periods. Scenarios should include relevant peak historic price volatilities, shifts in other market factors such as price determinants and yield curves, multiple defaults over various time horizons, simultaneous pressures in funding and asset markets, and a spectrum of forward-looking stress scenarios in a variety of extreme but plausible market conditions.

33


Key consideration 7 An FMI should establish explicit rules and procedures that address fully any credit losses it may face as a result of any individual or combined default among its participants with respect to any of their obligations to the FMI. These rules and procedures should address how potentially uncovered credit losses would be allocated, including the repayment of any funds an FMI may borrow from liquidity providers. These rules and procedures should also indicate the FMI’s process to replenish any financial resources that the FMI may employ during a stress event, so that the FMI can continue to operate in a safe and sound manner.

Description Allocation of credit losses If a participant ultimately fails to repurchase the securities under a repo with Banxico, the latter may dispose of the collateral that the defaulting participant has presented. Replenishment of financial resources There is no process to replenish financial resources. Banxico mitigates potential losses arising from intraday repos through collateral with low credit, liquidity and market risks, to which it applies conservative haircuts.

Key conclusions SPEI as such does not undertake credit risk. Banxico’s exposure to credit risk is limited to intra-day repos, whereas current account overdrafts carry no credit risk being these collateralized with cash at the central bank. Intraday repos with Banxico are collateralized with highly liquid assets characterized by low credit and market risk. Moreover, Banxico applies conservative haircuts. The collateral management system is operated efficiently through a link with the CSD/SSS.


Observed


-

34

PRINCIPLE 5. COLLATERAL An FMI that requires collateral to manage its or its participants’ credit exposure should accept collateral with low credit, liquidity, and market risks. An FMI should also set and enforce appropriately conservative haircuts and concentration limits. Key consideration 1

An FMI should generally limit the assets it (routinely) accepts as collateral to those with low credit, liquidity, and market risks.

Description Securities eligible for the repo transactions are strictly limited to Federal Government bonds (BONDES), IPAB securities, Federal Treasury certificates (CEDES, with the exclusion of CETES ESPECIALES), Banco de México’s Monetary Regulation Bonds (BREMS), and segregated coupons that belong to the financial institution.

Key consideration 2

An FMI should establish prudent valuation practices and develop haircuts that are regularly tested and take into account stressed market conditions.

Description Valuation practices Banxico marks-to-market collateral securities on a daily basis. Banxico’s valuation methodology is provided in Annex 7 of Circular No. 3/2012. Based on the prices provided by two price vendors, the price of the collateral is calculated using a random sampling from a uniform distribution. Haircutting practices Haircuts are defined according to the type of assets and on the basis of historic price volatility, the maturity date, and the term of the (repo, in this case) operation. In practice, Banxico calculates the weighted average of “significantly adverse” percentage changes that the price of the collateral securities may have experienced over a period of time equal to the term of repo operation. Haircut ratios are updated once every three months.

Key consideration 3

In order to reduce the need for pro-cyclical adjustments, an FMI should establish stable and conservative haircuts that are calibrated to include periods of stressed market conditions, to the extent practicable and prudent.

Description The haircut methodology used by Banxico is conservative in that it considers a 10+ year observation period which includes observed extreme prices volatilities.

Key consideration 4

An FMI should avoid concentrated holdings of certain assets where this would significantly impair the ability to liquidate such assets quickly without significant adverse price effects.

Description Banxico does no limit concentrated holdings of certain assets. In fact, the assets it accepts as collateral have low credit, liquidity, and market risks and can therefore be liquidated quickly without any adverse price effects.

Key consideration 5

An FMI that accepts cross-border collateral should mitigate the risks associated with its use and ensure that the collateral can be used in a timely manner.

35

Description Not applicable. Banxico does not accept any cross-border collateral.

Key consideration 6

An FMI should use a collateral management system that is well-designed and operationally flexible.

Description Collateral management system design The collateral management system used is the Módulo Reportos para Proporcionar Liquidez al Sistema de Pagos (RSP) operated by the DSP. The RSP system enables Banxico to extend intraday repo support to banks and broker-dealers in DALI, i.e. liquidity is credited in the cash accounts financial institutions hold at DALI. Alternatively, funds can be credited to SIAC accounts. Liquidity can flow freely between accounts at DALI and SIAC, SIAC and SPEI, DALI and SPEI as necessary during RSP operating hours. SPEI membership does not overlap exactly with SIAC’s and DALI’s though; in fact, while all banks have accounts at all three systems, only a few broker-dealers maintain accounts at SPEI. From a RSP perspective, it is irrelevant whether an institution has an account at SPEI. Through the RSP system, Banxico can dispose of the collateral when applicable. Operational flexibility The RSP system is operationally sound and falls within the scope of the DSP operational risk management framework. As of August 2015, RSP availability had reached 99.97 percent. RSP system availability is tracked against a pre-established target, and is regularly reported to senior management.

Key conclusions Securities eligible as collateral are limited to bonds having low credit, liquidity, and market risks. Collateral securities are marked-to-market daily, and collateral valuation practices are prudent. Haircuts are conservative and have proved stable over time. The haircut ratios are updated once every three months. However, the haircut methodology does not incorporate, or is tested against, assumptions about collateral value fluctuations in stressed market conditions. An independent validation of the haircut methodology is not available. The collateral management system is operated efficiently through a linkage to the central securities depository and settlement system.


Broadly Observed

Recommendations and Comments

Banxico should incorporate assumptions about collateral value during stressed market conditions into the haircut methodology and undertake regular stress testing. International standards recommend that haircut procedures should be independently validated at least annually.

36

PRINCIPLE 7: LIQUIDITY RISK An FMI should effectively measure, monitor, and manage its liquidity risk. An FMI should maintain sufficient liquid resources in all relevant currencies to effect same-day and, where appropriate, intraday and multiday settlement of payment obligations with a high degree of confidence under a wide range of potential stress scenarios that should include, but not be limited to, the default of the participant and its affiliates that would generate the largest aggregate liquidity obligation for the FMI in extreme but plausible market conditions. Key consideration 1

An FMI should have a robust framework to manage its liquidity risks from its participants, settlement banks, nostro agents, custodian banks, liquidity providers, and other entities.

Description SPEI is not exposed to liquidity risks nor does it creates direct liquidity exposures between participants. SPEI is a near real-time hybrid settlement system. A multilateral offsetting algorithm selects those payment orders that can be settled based on available balances in the participants’ settlement accounts. On average, payments are settled every 1.9 second. Payments that cannot be settled are queued until sufficient funds become available. Pending payments by close of business day are cancelled. Banxico supports participants’ liquidity management in SPEI through intraday current account overdrafts and repo operations.5 Banxico indicates that as a central bank, Banxico would be able to provide unlimited liquidity support to systems’ participants – hence it does not face liquidity risk. In practice, overdrafts are capped at the amount of eligible deposits at the central banks, while repos can only be used within the limits established by regulation and ultimately depend on the participant holding sufficient collateral of the type accepted by Banxico. Thereby, participants bear any remaining liquidity risk. It is worth noting that (i) current account overdrafts are applicable only to credit institutions, and; (ii) by law, Banxico can only provide credit to the Federal Government, credit institutions, and IPAB (art. 7, par. II of the Banco de Mexico’s Law). Therefore, non-bank participants cannot avail themselves of Banxico’s intraday liquidity provisions, with the exception of broker-dealers, who can undertake repo operations with credit institutions with funds from repos between Banxico and the credit institutions.

Key consideration 2

An FMI should have effective operational and analytical tools to identify, measure, and monitor its settlement and funding flows on an ongoing and timely basis, including its use of intraday liquidity.

Description As compared to a purely real-time gross settlement mechanism, SPEI design allows optimizing participants’ liquidity management through extremely frequent batch settlement, thus reducing the amount of resources needed to settle payments in SPEI. The multilateral offsetting algorithm determines which payments can be settled based on the funds available in the participants’ accounts at the time of settlement.

5 Technically, intraday liquidity is not a SPEI feature. In fact, liquidity is credited to the cash accounts financial institutions hold at DALI or alternatively to SIAC accounts. SPEI participants can transfer this liquidity from DALI or SIAC to SPEI accounts as necessary. However, the great majority of these funds are exhausted in DALI.

37

Moreover, SPEI allows participants to (i) assign priorities to their transfer orders (high or normal), and (ii) reserve part of their balances for high-priority payments. The liquidity-saving algorithm tries to settle high-priority transfer orders first, by drawing from reserved and unreserved funds in the participant’s settlement account. Upon settlement and regardless of the topology chosen by the sender, the system notifies the sender and the recipient of which transfer orders were settled and updates the settlement account balances. SPEI has a central queuing mechanism although participants cannot change the order of queued payments. The effectiveness of these operational tools is monitored on an ongoing and real-time basis by the DSP. Banxico publishes monthly statistics on the use of intraday liquidity mechanisms. In April 2016, the average daily maximum overdrafts reached MXN 212,927 million, whereas the average daily maximum balance in the RSP system was MXN 180,217 million, presenting 32 percent and 27 percent of average daily volumes settled in SPEI, respectively. With the exception of the 19:00-20:00 window which corresponds to scheduled payments (pagos programados) initiated by TESOFE (i.e. government disbursements), the daily peak time is between 12:00 and 14:00, with 225,000 payments on average of which 218,000 are customer payments.

Key consideration 3

A payment system or SSS, including one employing a DNS mechanism, should maintain sufficient liquid resources in all relevant currencies to effect same-day settlement, and where appropriate intraday or multiday settlement, of payment obligations with a high degree of confidence under a wide range of potential stress scenarios that should include, but not be limited to, the default of the participant and its affiliates that would generate the largest aggregate payment obligation in extreme but plausible market conditions.

Description SPEI is owned and operated by Banxico, which is the central bank and the lender of last resort in Mexican peso, the settlement currency. Further, Banxico provides intraday liquidity support to the participant on a collateralized basis. These factors enable SPEI to continuously settle transactions on a net, near-real time basis.

Key consideration 4

A CCP should maintain sufficient liquid resources in all relevant currencies to settle securities-related payments, make required variation margin payments, and meet other payment obligations on time with a high degree of confidence under a wide range of potential stress scenarios that should include, but not be limited to, the default of the participant and its affiliates that would generate the largest aggregate payment obligation to the CCP in extreme but plausible market conditions. In addition, a CCP that is involved in activities with a more-complex risk profile or that is systemically important in multiple jurisdictions should consider

38

maintaining additional liquidity resources sufficient to cover a wider range of potential stress scenarios that should include, but not be limited to, the default of the two participants and their affiliates that would generate the largest aggregate payment obligation to the CCP in extreme but plausible market conditions.

Description Sufficient liquid resources Not applicable. Risk profile and systemic importance in multiple jurisdictions Not applicable.

Key consideration 5

For the purpose of meeting its minimum liquid resource requirement, an FMI’s qualifying liquid resources in each currency include cash at the central bank of issue and at creditworthy commercial banks, committed lines of credit, committed foreign exchange swaps, and committed repos, as well as highly marketable collateral held in custody and investments that are readily available and convertible into cash with prearranged and highly reliable funding arrangements, even in extreme but plausible market conditions. If an FMI has access to routine credit at the central bank of issue, the FMI may count such access as part of the minimum requirement to the extent it has collateral that is eligible for pledging to (or for conducting other appropriate forms of transactions with) the relevant central bank. All such resources should be available when needed.

Description Size and composition of qualifying liquid resources SPEI is an FMI owned and operated by Banxico, which is the issuer of currency and the lender of last resort. Banxico is in a position to meet the MXN requirements of all participants at any point in time for settling their transactions. Availability and coverage of qualifying liquid resources SPEI is an FMI owned and operated by Banxico, which is the issuer of currency and the lender of last resort. Banxico is in a position to meet the MXN requirements of all participants at any point in time for settling their transactions.

Key consideration 6

An FMI may supplement its qualifying liquid resources with other forms of liquid resources. If the FMI does so, then these liquid resources should be in the form of assets that are likely to be saleable or acceptable as collateral for lines of credit, swaps, or repos on an ad hoc basis following a default, even if this cannot be reliably prearranged or guaranteed in extreme market conditions. Even if an FMI does not have access to routine central bank credit, it should still take account of what collateral is typically accepted by the relevant central bank, as such assets may be more likely to be liquid in stressed circumstances. An FMI should not assume the

39

availability of emergency central bank credit as a part of its liquidity plan.

Description Size and composition of supplemental liquid resources SPEI is an FMI owned and operated by Banxico, which is the issuer of currency and the lender of last resort. Banxico is in a position to meet the MXN requirements of all participants at any point in time for settling their transactions.

Key consideration 7

An FMI should obtain a high degree of confidence, through rigorous due diligence, that each provider of its minimum required qualifying liquid resources, whether a participant of the FMI or an external party, has sufficient information to understand and to manage its associated liquidity risks, and that it has the capacity to perform as required under its commitment. Where relevant to assessing a liquidity provider’s performance reliability with respect to a particular currency, a liquidity provider’s potential access to credit from the central bank of issue may be taken into account. An FMI should regularly test its procedures for accessing its liquid resources at a liquidity provider.

Description Use of liquidity providers Not applicable. The liquidity provider for SPEI is Banxico itself. Reliability of liquidity providers Not applicable. The liquidity provider for SPEI is Banxico itself.

Key consideration 8

An FMI with access to central bank accounts, payment services, or securities services should use these services, where practical, to enhance its management of liquidity risk.

Description SPEI settles all transactions in central bank money, through the settlement accounts that participants hold at Banxico.

Key consideration 9

An FMI should determine the amount and regularly test the sufficiency of its liquid resources through rigorous stress testing. An FMI should have clear procedures to report the results of its stress tests to appropriate decision makers at the FMI and to use these results to evaluate the adequacy of and adjust its liquidity risk-management framework. In conducting stress testing, an FMI should consider a wide range of relevant scenarios. Scenarios should include relevant peak historic price volatilities, shifts in other market factors such as price determinants and yield curves, multiple defaults over various time horizons, simultaneous pressures in funding and asset markets, and a spectrum of forward-looking stress scenarios in a variety of extreme but plausible market conditions. Scenarios should also take into account the design and operation of the FMI, include all entities that might pose material liquidity risks to the FMI (such as settlement banks, nostro agents, custodian banks, liquidity providers, and linked FMIs), and where appropriate, cover a multiday period. In all cases, an FMI should document its supporting rationale for, and should have appropriate governance

40

arrangements relating to, the amount and form of total liquid resources it maintains.

Description Stress test programme There is no documented stress test programme for determining and testing the sufficiency of liquid resources. As the liquidity provider for SPEI is the central bank itself, in principle the sufficiency and availability of funds to support participants’ operations are unlimited. Banxico has nevertheless limited its liquidity support to SPEI participants by implementing all associated liquidity injections through the use of collateralized overdrafts and repos. Stress test scenarios There is no documented stress test programme for determining and testing the sufficiency of liquid resources. Review and validation There is no documented stress test programme for determining and testing the sufficiency of liquid resources.

Key consideration 10

An FMI should establish explicit rules and procedures that enable the FMI to effect same-day and, where appropriate, intraday and multiday settlement of payment obligations on time following any individual or combined default among its participants. These rules and procedures should address unforeseen and potentially uncovered liquidity shortfalls and should aim to avoid unwinding, revoking, or delaying the same-day settlement of payment obligations. These rules and procedures should also indicate the FMI’s process to replenish any liquidity resources it may employ during a stress event, so that it can continue to operate in a safe and sound manner.

Description Same day settlement SPEI is a central bank-owned and operated hybrid system which settles transactions on a net, near real-time basis. SPEI operates on a 24/7 basis. Any payment instructions that remain in the queue by end-of-day closure (cierre de operaciones) at 17:59:59 of t+1 are cancelled from the system. Extensions of regular operating hours (i.e. extensions beyond the scheduled closure of operations) to complete settlement are exceptional in nature and not explicitly contemplated in the system’s Operating Manual. In 2015, there were five cases of Banxico extending SPEI’s operating hours owing to operational and technical issues. The longest extension (70 minutes) was due to SIAC’s temporary inability to process operations.

41

Participants can cancel/revoke a payment instruction as long as this has not been settled (par. 5.6 of the SPEI operating manual, see also Principles 1 and 8). Cancellation/revocation does not require the consent of recipient/beneficiary. If the payment to be cancelled had been sent under topology T, the entire payment instruction is cancelled. Replenishment of liquidity resources Not applicable. SPEI is a same-day settlement system and the liquidity provider is Banxico itself.

Key Conclusions SPEI is not exposed to liquidity risks, which are borne entirely by system participants. SPEI nevertheless supports the sound and efficient management of participants’ liquidity. First, extremely frequent batch settlement reduces the amount of liquid resources needed to settle payments in SPEI. Second, Banxico has devised a variety of tools to help participants in allocating resources efficiently (e.g. priority setting, reserved balance). Finally, Banxico provides collateralized intraday liquidity support to banks and broker-dealers through banks. In general, these tools have proved adequate and effective in smoothening the settlement and funding flows, and are monitored on a real-time and ongoing basis.


Observed


Banxico should continue to monitor the use of repos by broker-dealers with a view to ensure that such tool can be efficiently used when needed. While Banxico’s regulations require that repos between credit institutions and broker-dealers with funds from repos with Banxico have the same characteristics as the latter repos, and increase the intraday credit limits applicable to banks who provide this facility, the conditions including amount and pricing of intraday repos with broker-dealers depend on each bank’s policies. To the extent that these practices may be limiting the efficiency of repos and pose a concern for SPEI’s liquidity, they should be monitored by Banxico.

42

PRINCIPLE 8: SETTLEMENT FINALITY An FMI should provide clear and certain final settlement, at a minimum by the end of the value date. Where necessary or preferable, an FMI should provide final settlement intraday or in real time Key consideration 1 An FMI’s rules and procedures should clearly define the point

at which settlement is final. Description

Point of settlement finality According to SPEI rules (art. 5), once the settlement has completed and the system has sent the sender and the recipient the respective notifications of settlement, the payment instruction is to be considered “accepted” for the purposes of the Payments System Law, thus final, irrevocable, enforceable, and binding before third parties (see art. 11 of the Payments System Law). Consistently with SPEI rules, as per SPEI operating manual a payment instruction is “accepted” once it has been settled and after the system has notified the parties of the settlement. The notification of the payment instruction to the recipient under typology T is not to be interpreted as a proof of accepted payment, as its only purpose is to inform the recipient about the sender’s intention to make the payments as indicated in the message. As a corollary, a payment instruction can be cancelled if and only if it has not been settled, regardless of the topology chosen by the sender. In practice, payment instructions are processed in two steps:

i. the system receives the payment instruction and, after verifying the electronic signature, places it in a queue of pending instructions where it will remain until it can be settled, and sends a message of acknowledgment of receipt to the sender;

ii. the system determines – based on a mathematic formula that takes into account the participants’ balances and all the pending payment instructions, as well as the priorities set by the participants – which instructions can be cleared and settled. At this stage, the system marks the instructions as accepted, updates the participants’ balances and sends the notification of settlement to the participants.

While the Payments System Law defers to the internal rules of a payment system to establish the requirements for the settlement, it defines as “accepted” a payment instruction that has passed all risk controls and is ready to be settled (art. 2, par VI). Circular No. 17/2010 (SPEI Rules), as well as the system’s operational manual and contracts, are available to the participants. SPEI Rules are a public document and have been posted on Banxico’s website.

43

Finality in the case of links Not applicable.

Key consideration 2 An FMI should complete final settlement no later than the end of the value date, and preferably intraday or in real time, to reduce settlement risk. An LVPS or SSS should consider adopting RTGS or multiple-batch processing during the settlement day.

Description

Final settlement on the value date All payments through SPEI are settled on a near real time basis (every 1.9 seconds on average), from 18:00 (t) to 17:59:59 (t+1). Payment instructions stored in queues owing to insufficient balances in participants’ settlement accounts are cancelled at the end of the operating day. While SPEI rules provide that Banxico can extend operating hours in case of contingency, SPEI Operating Manuals do not contemplate / regulate such extensions. In 2015, there were five episodes of extension of operating hours due to operational and technical issues. Intraday or real-time final settlement SPEI is a hybrid system that provides intra-day settlement on a net basis in near real time (every 1.9 seconds on average).

Key consideration 3 An FMI should clearly define the point after which unsettled payments, transfer instructions, or other obligations may not be revoked by a participant.

Description

SPEI rules establish that participants can send instructions to cancel transfer orders, although the system will not cancel payments that have been accepted. Since the rules defines as accepted those payment instructions that have been settled and whose settlement has been notified to the relevant participants by the system, it follows that payment instructions pending settlement can still be canceled/revoked. Neither the SPEI Rules nor the Operating Manual require that the consent of the recipient is obtained.

Key conclusions

Settlement of payment transfers in SPEI is achieved in near-real time and payments once settled are final and irrevocable. The settlement arrived at in the SPEI system is protected under article 11 of the Payments System Law. SPEI Rules clearly define the point of at which settlement is deemed final: once settled, and after the system has notified the participants that it has debited/credited their respective accounts, a payment becomes “accepted” for the purposes of the Payments System Law, thus is final and irrevocable. As a corollary, the participants can cancel/revoke a payment instruction which is placed in the queue of pending payments.

44

Revocation and cancellation do not require the consent of the beneficiary institution.


Observed


Unsettled (pending) payments may be revoked until they are settled with finality, including topology T payment instructions. The 2012 FSAP recommended that topology T be reviewed since most systems do not notify incoming payments that have not yet settled with finality. Alternatively, Banxico could consider requiring the consent of the beneficiary institution for the revocation of a payment instruction initiated with topology T (and of which the beneficiary institution has received notification). Indeed, although SPEI Rules warn participants that they should not consider a notification as a proof of accepted payment, they do not explicitly prohibit that the beneficiary institutions credit their customers prior to receiving the funds in their SPEI account.

45

PRINCIPLE 9: MONEY SETTLEMENTS An FMI should conduct its money settlements in central bank money where practical and available. If central bank money is not used, an FMI should minimize and strictly control the credit and liquidity risk arising from the use of commercial bank money. Key consideration 1 An FMI should conduct its money settlements in central bank

money, where practical and available, to avoid credit and liquidity risks.

Description SPEI settles all payment instructions in central bank money through the settlement accounts that participants hold at Banxico. SPEI only conducts money settlements in Mexican peso.

Key consideration 2 If central bank money is not used, an FMI should conduct its money settlements using a settlement asset with little or no credit or liquidity risk.

Description SPEI settles all payment instructions in central bank money through the settlement accounts that participants hold at Banxico.

Key consideration 3 If an FMI settles in commercial bank money, it should monitor, manage, and limit its credit and liquidity risks arising from the commercial settlement banks. In particular, an FMI should establish and monitor adherence to strict criteria for its settlement banks that take account of, among other things, their regulation and supervision, creditworthiness, capitalisation, access to liquidity, and operational reliability. An FMI should also monitor and manage the concentration of credit and liquidity exposures to its commercial settlement banks.

Description Not applicable. Key consideration 4 If an FMI conducts money settlements on its own books, it

should minimize and strictly control its credit and liquidity risks. Description SPEI settles all payment instructions in central bank money through

the settlement accounts that participants hold at Banxico. Key consideration 5 An FMI’s legal agreements with any settlement banks should

state clearly when transfers on the books of individual settlement banks are expected to occur, that transfers are to be final when effected, and that funds received should be transferable as soon as possible, at a minimum by the end of the day and ideally intraday, in order to enable the FMI and its participants to manage credit and liquidity risks.

Description Not applicable. Key conclusions SPEI settles all payment instructions in central bank money through

the settlement accounts that participants hold at Banxico. Assessment of Principle 9

Observed


-

46

PRINCIPLE 13: PARTICIPANT-DEFAULT RULES AND PROCEDURES An FMI should have effective and clearly defined rules and procedures to manage a participant default. These rules and procedures should be designed to ensure that the FMI can take timely action to contain losses and liquidity pressures and continue to meet its obligations. Key consideration 1 An FMI should have default rules and procedures that enable

the FMI to continue to meet its obligations in the event of a participant default and that address the replenishment of resources following a default.

Description Participant default rules and procedures SPEI settles payments similarly to a real-time gross settlement system; therefore, participants do not suffer from default on each other or against the system as a result of the settlement process. Payment orders that have not been settled by the end of the operational day (cierre de operaciones) are removed from the central processing queue. Moreover, legal protections apply that guarantee the settlement finality in the event of bankruptcy and insolvency procedures. However, Banxico may face exposure to participants as a result of granting intraday liquidity through collateralized repos (see Principles 4 and 5), in the event that a participant fails to repurchase the securities. In these cases, Banxico can dispose of the collateral that the defaulting participant has presented. Repos can be automatically renewed at Banxico’s discretion (in practice, up to a maximum of ten consecutive days) before being considered as abandoned, although the reiterated renovation of repos is not considered a good practice. The failure to repurchase securities by a broker-dealer in the context of a repo with a credit institution (second repo, according to the order of registration in the RSP system) using funds from a repo between the credit institution and Banxico (first repo) results in the credit institution acquiring the collateral. The same rules as described above would apply to the first repo between the credit institution and Banxico. Renewal of intraday liquidity is subject to a penalty rate equal to twice the market rate if the participant does not have sufficient balance in its SIAC’s account. Charges are made in the participants’ accounts at SIAC. It is worth noting that collateral pledged in a payment system is protected against third-party claims under art. 15 of the Payments Systems Law. Use of financial resources

47

Banxico (i) does not face the risk of lack of funds to meet its payment obligations, (ii) does not depend on third parties for this purpose, and (iii) does not contribute to participants meeting their own payment obligations. With regard to participants’ failure to repurchase the securities under a repo agreement with Banxico for the provision of intraday liquidity, Banxico may sell collateral securities in the financial markets.

Key consideration 2 An FMI should be well prepared to implement its default rules and procedures, including any appropriate discretionary procedures provided for in its rules.

Description In principle, when a credit institution fails to repurchase the securities Banxico sells its collateral securities in the financial market. Circular No. 3/2012 that regulates the use of repo with Banxico for the purposes of intraday liquidity provides the criteria for abandoning or automatically renewing a repo transaction. Banxico can unilaterally determine the maximum number of renewals that can be granted to the defaulting credit institution.

Key consideration 3 An FMI should publicly disclose key aspects of its default rules and procedures.

Description Circular No. 3/2012 provides the rules governing the default of a credit institution to repurchase the securities. It is a public document and is available on Banxico’s website.

Key consideration 4 An FMI should involve its participants and other stakeholders in the testing and review of the FMI’s default procedures, including any close-out procedures. Such testing and review should be conducted at least annually or following material changes to the rules and procedures to ensure that they are practical and effective.

Description Any testing of default rules and procedures is not conducted within the framework of SPEI. Strictly speaking, rules concerning intraday repos fall outside of SPEI’s scope. There are no mechanisms established to obtain feedback from SPEI participants when enacting the rules and procedures concerning defaults by financial institutions utilizing intraday repos.

Key conclusions SPEI design does not allow for defaults between participants, or between the participants and the system itself. However, a participant can default on the repayment of intraday liquidity (repos). Banxico’s regulations provide for the use of intraday repos for purposes of intraday liquidity, including the procedures applicable in the event that a participant fails to repurchase securities by end of day. In light of the Payments Systems Law, application of collateral posted in the RPS system cannot be subject to prevention, stay, or reversal.

48

Any testing or review of default rules and procedures are not conducted within the framework of SPEI. Strictly speaking, rules concerning intraday repos fall outside of SPEI’s scope.


Observed


The assessor coincides with Banxico that default rules and procedures for intraday repos fall outside of SPEI’s scope strictly speaking. Yet, for the same reasons outlined above (see Principle 3), it is suggested that participant default risk management (as far as intraday repo are concerned) is considered in close coordination with SPEI risk management framework. Banxico should involve SPEI participants in the review of the rules and procedures with regard to default of intraday repos.

49

PRINCIPLE 15: GENERAL BUSINESS RISK An FMI should identify, monitor, and manage its general business risk and hold sufficient liquid net assets funded by equity to cover potential general business losses so that it can continue operations and services as a going concern if those losses materialize. Further, liquid net assets should at all times be sufficient to ensure a recovery or orderly wind-down of critical operations and services. Key consideration 1 An FMI should have robust management and control systems

to identify, monitor, and manage general business risks, including losses from poor execution of business strategy, negative cash flows, or unexpected and excessively large operating expenses.

Description SPEI is a central bank-operated system. It is one of the core functionalities of Banxico, and a tool to fulfill its statutory mandate to ensure the smooth functioning of payment systems (art. 2 of the Banco de Mexico’s Law). Moreover, Banxico charges SPEI participants a service fee aimed to recover the system’s operational costs, having already recovered the initial investment costs. Operational costs include infrastructure (hardware, software) maintenance costs and other operational costs (e.g. physical space), human resources, and system upgrades. Therefore, SPEI’s exposure to business risk is limited to a potential underestimation of its operational costs. For instance, business risk could materialize if certain cost factors were omitted or as a result of an unexpected increase in operational costs. For this purpose, Banxico undertakes an annual analysis of costs and revises participants’ fees accordingly.

Key consideration 2

An FMI should hold liquid net assets funded by equity (such as common stock, disclosed reserves, or other retained earnings) so that it can continue operations and services as a going concern if it incurs general business losses. The amount of liquid net assets funded by equity an FMI should hold should be determined by its general business risk profile and the length of time required to achieve a recovery or orderly wind-down, as appropriate, of its critical operations and services if such action is taken.

Description Not applicable. Key consideration 3 An FMI should maintain a viable recovery or orderly wind-

down plan and should hold sufficient liquid net assets funded by equity to implement this plan. At a minimum, an FMI should hold liquid net assets funded by equity equal to at least six months of current operating expenses. These assets are in addition to resources held to cover participant defaults or other risks covered under the financial resources principles. However, equity held under international risk-based capital standards can be included where relevant and appropriate to avoid duplicate capital requirements.

Description Recovery or orderly wind-down plan

50

Not applicable. Resources Not applicable. Yet, Banxico maintains a contingency fund that covers up to 18 months of current operating expenses without revenues aimed to face a situation where revenues from participants’ fees are insufficient to meet SPEI’s obligations to its suppliers.

Key consideration 4 Assets held to cover general business risk should be of high quality and sufficiently liquid in order to allow the FMI to meet its current and projected operating expenses under a range of scenarios, including in adverse market conditions.

Description Not applicable. Key consideration 5 An FMI should maintain a viable plan for raising additional

equity should its equity fall close to or below the amount needed. This plan should be approved by the board of directors and updated regularly.

Description Not applicable. Key conclusions SPEI is a central bank-owned and operated FMI. Given the central

bank’s inherent soundness, general business risk is not deemed as relevant. Banxico has a pricing policy for SPEI services which is reviewed annually and allows covering operating costs in full.


Observed.


-

51

PRINCIPLE 16. CUSTODY AND INVESTMENT RISKS An FMI should safeguard its own and its participants’ assets and minimise the risk of loss on and delay in access to these assets. An FMI’s investments should be in instruments with minimal credit, market, and liquidity risks. Key consideration 1 An FMI should hold its own and its participants’ assets at

supervised and regulated entities that have robust accounting practices, safekeeping procedures, and internal controls that fully protect these assets.

Description The assets of Banxico as the owner and operator of SPEI, and SPEI participants’ assets are safeguarded in accounts kept at and managed by Banxico itself. Account management is based on sound accounting practices that are well documented, and is subject to auditing. When repo operations are taken into account, Banxico holds its own and SPEI participants’ financial assets received as collateral in S.D. INDEVAL (hereinafter, INDEVAL) – the single central securities depository (CSD) licensed in Mexico. The majority shareholder of INDEVAL is the Bolsa Mexicana de Valores, S.A. de C.V. (97%), while Banxico holds 2.5% of INDEVAL’s shares. As established in the Securities Market Law (SML), art. 277, one-fourth of Board members must be independent, including a representative of Banxico. Currently, Banxico is represented in INDEVAL’s Board by the Director General of Payment Systems and Corporate Services. INDEVAL is licensed by the Ministry of Finance with the opinion of Banxico and the CNBV (art. 272 of the SML) and is jointly regulated and supervised by Banxico and the CNBV. INDEVAL’s internal regulations and any amendments must be approved by Banxico and the CNBV (SML, art. 294). Banxico and the CNBV jointly undertake the assessment of INDEVAL against the PFMI and oversee the principles’ implementation plan.

Key consideration 2 An FMI should have prompt access to its assets and the assets provided by participants, when required.

Description Banxico has real-time access to the collateral deposited in its account at INDEVAL, and can dispose of collateralized securities through the RSP system linked to DALI.

Key consideration 3 An FMI should evaluate and understand its exposures to its custodian banks, taking into account the full scope of its relationships with each.

Description Not applicable. There are no separate individual custodian banks with regard to the custody of the collateral.

Key consideration 4 An FMI’s investment strategy should be consistent with its overall risk-management strategy and fully disclosed to its participants, and investments should be secured by, or be claims on, high-quality obligors. These investments should allow for quick liquidation with little, if any, adverse price effect.

Description Investment strategy

52

Not applicable. Banxico as operator of SPEI does not make investments with the assets pledged by other parties. Risk characteristics of investments Not applicable. Banxico as operator of SPEI does not make investments with the assets pledged by other parties.

Key conclusions INDEVAL is the sole CSD in Mexico established under the SML. Consistently with the provisions of the SML, INDEVAL/DALI provides a centralized depository for securities, and securities clearing and settlement. Banxico owns 2.5% of INDEVAL’s shares and is represented in the Board of Directors. Jointly with the CNBV, Banxico regulates and supervises the FMI operations. Banxico’s approval is required for any changes in the FMI internal regulations.


Observed


Given the critical nature of the services provided by INDEVAL, Banxico in collaboration with the CNBV should assess INDEVAL/DALI at frequent intervals as well as enforce the disclosure of its rules, key procedures, and market data according to the CPMI-IOSCO disclosure framework format.

53

PRINCIPLE 17: OPERATIONAL RISK An FMI should identify the plausible sources of operational risk, both internal and external, and mitigate their impact through the use of appropriate systems, policies, procedures, and controls. Systems should be designed to ensure a high degree of security and operational reliability and should have adequate, scalable capacity. Business continuity management should aim for timely recovery of operations and fulfillment of the FMI’s obligations, including in the event of a wide-scale or major disruption. Key consideration 1 An FMI should establish a robust operational risk-management

framework with appropriate systems, policies, procedures, and controls to identify, monitor, and manage operational risks.

Description Identification of operational risk SPEI operational risk management is embedded in, and informed by, Banxico’s Internal Control System – i.e., the organization and set of activities, regulations, policies, standards and procedures established to provide a reasonable level of security with respect to certain institutional objectives. In this context, operational risk is defined as risk caused by human error, organizational or other factors related to equipment and information. Process owners are tasked with the identification and management of the risks inherent to the processes they administer, whereas the Directorate General of Comptroller and Risk Management provides the overall criteria and methodologies. The Internal Control System framework is documented in Banxico’s internal regulations. Internal Control is comprised of five components: control environment, risk assessment, control activities, information and communication, and supervision. Each of Banxico’s administrative unit is responsible for the implementation of these activities within their area of competence. In this context, the DSP has documented a comprehensive risk management framework for SPEI. Within this framework, general risk identification and evaluation consists of: (i) mapping of the processes to identify critical processes and the control points; (ii) self-assessment of the risks and controls undertaken by the DSP; (iii) incident data collection and analysis, and; (iv) internal and external audit. Through the application of these tools, risks are identified and evaluated on the basis of the frequency of their occurrence (i.e. the frequency with which a risk may materialize in a given period) and the impact (i.e. how the risk would affect the system if it materialized) (see Principle 3). The framework prioritizes operational risk which it defines as comprising system-related, infrastructure, process-related, human and external risk factors. Management of operational risk The DSP and DGTI have established the controls for the identified risks. Controls are of two types: (i) preventive, i.e. to decrease the frequency of the occurrence of the risk which include policies, procedures, and manuals; (ii) corrective, i.e. to minimize the impact of the materialization of the risks which include warning systems.

54

The effectiveness of the controls in decreasing the frequency and impact of the risks is monitored at a minimum of a yearly basis. Banxico’s mandate to foster the smooth functioning of the payment systems relies on the DSP. SPEI operational risk management is complemented by Banxico’s risk management, audit, and information technology functions. Banxico has an Internal Control System in place that assigns risk management responsibilities to the owner of the underlying process. SPEI rules entrust Banxico as the system operator with the management of situations of contingency (art.10). Banxico can (i) extend SPEI operating hours; (ii) instruct the participants to suspend payment instructions; (iii) instruct the participants to continue operations through the use of business continuity procedures; (iv) activate alternate operating procedures (POA), whereas if the disruption happens in the application of a participant, the latter must activate the client alternate operating procedures (COAS). Moreover, Banxico can suspend or terminate a participant that could jeopardize the safety of the system or does not comply with system’s regulations. SPEI operating manual details business continuity procedures (5.17.1 – 5.17.4), including POA-SPEI, COAS, whereas contingencies affecting operations with CLS are addressed in a separate manual. The DSP has taken a comprehensive approach to the management of business continuity which includes all DSP-operated systems and the critical assets for its service provision. The business continuity management system is comprised of the (ii) organizational arrangements (i.e. DSP activities, functions, services, and relevant parties), (ii) risk factors, and (iii) objectives and scope of business continuity. It is worth mentioning in this context that systems’ availability and recovery time targets are reported to the Board on an annual basis in the context of the institutional implementation plan, guiding principle 7 (see Principles 2 and 3). Policies, processes and controls DSP operational risk management framework is based on the following commercial standards and best international practices: ISO 22301:2012 – Business Continuity Management Systems; ISO/IEC 27001 – Information Security Management; X.509 v3 (RFC 3280) and PKCS #1 (RFC 2313). The Internal Control System is based on COSO.

55

The DSP risk management activities benefit from external and internal audit, whose findings and recommendations are embedded in risk identification and evaluation processes. The Directorate General of Comptroller and Risk Management provides the overall methodology and oversees the implementation of the Internal Control System. It has also undertaken an evaluation of the risks inherent to the management and operation of Banxico-administered payment systems. Banxico’s personnel policy governs the human resource allocation to the DSP/SPEI.

Key consideration 2 An FMI’s board of directors should clearly define the roles and responsibilities for addressing operational risk and should endorse the FMI’s operational risk-management framework. Systems, operational policies, procedures, and controls should be reviewed, audited, and tested periodically and after significant changes.

Description Roles, responsibilities and framework Art. 46, par. V of the Banco de Mexico’s Law entrusts the Board with the definition of the policies and criteria under which the Bank undertakes its operations. The Law provides that, depending on their importance, certain policies must be submitted to the Board for approval. Banxico has developed an Internal Control System whereby each of Banxico’s administrative unit is responsible for the implementation of internal controls within their respective areas of competence. Process owners are tasked with the identification and administration of the risks inherent to the processes they manage, whereas the Directorate General of Comptroller and Risk Management provides the overall criteria and methodologies. The Internal Control System framework is documented in Banxico’s internal regulations. Its implementation is overseen by the Internal Control System Monitoring Committee, who reports to the Governor. Banxico’s Internal Regulation (Reglamento Interior) assigns the DSP clear responsibilities as far as (i) operating central bank-owned systems and (ii) monitoring them so as to ensure their proper functioning, and (iii) establishing business continuity policies. Accordingly, the DSP has developed a comprehensive risk management framework (see Principles 3) that identifies operational risk as relevant to SPEI operations, and a DSP-wide business continuity plan (see Principle 17, KC3). Within the DSP, the Subdivision of Payment Systems Operational Continuity specializes in risk assessment and operational continuity. It is worth noting that risk management is one of the guiding principles that comprise Banxico’s institutional plan, namely Guiding Principle 7 – “Strengthen the internal control system, risk

56

management, security, and physical and information security of the Bank”. Enhancing the operational reliability and business continuity of the payment systems is one of 7 objectives under Guiding Principle 7. The relevant indicators are (i) the availability of the systems, and (ii) the recovery time. The plans and achievements in meeting this objective are reported to the Board on an annual basis. Review, audit and testing The comprehensive risk management framework was issued in January 2016. It is established that the framework is updated at least annually, or when relevant changes occur in the system /infrastructure, the regulatory framework, or the organizational structure. The business continuity plan (BCP) was first elaborated in 2013. Since then, it has been updated in 2013, 2014, and 2016. Revision criteria include changes of various nature (technological, organizational, etc.) new types of threats, as well as the outcomes of the testing and auditors’ recommendations. The BCP is tested at least annually. The DSP is subject to internal and external audit. Internal audits allow identifying situations of non-compliance with internal rules and manuals, as well as risks related to SPEI that require implementation of controls. The Directorate of Auditing reports to the Board of Governors. SPEI external audits have focused on information security. In 2015, the DSP has undergone six audits, of which four were internal. The Director General of Audit and the Audit Committee report to the Board of Governors.

Key consideration 3 An FMI should have clearly defined operational reliability objectives and should have policies in place that are designed to achieve those objectives.

Description Strengthening the internal control system, risk management and IT and physical security is an institutional objective established in Banxico’s work plan, As far as payment systems / SPEI are concerned, it translates into the objective of ensuring payment systems’ continuity. This objective is measured through (i) the availability of the systems, and; (ii) the recovery time. SPEI availability target for 2016 was set at 99.85 percent, up from 99.80 percent in 2015. Availability testing report higher availability. Recovery time has been set to 30 minutes. The overall risk management policy and operational continuity arrangements are intended to ensure that these objectives are achieved. Progress reports are sent to the Board of Governors on a

57

quarterly basis, whereas the Operational Continuity Committee was reports to the Governor. The Committee is chaired by the Governor and comprises the Directors General and the Comptroller General of Banxico.

Key consideration 4 An FMI should ensure that it has scalable capacity adequate to handle increasing stress volumes and to achieve its service-level objectives.

Description SPEI can handle up to 4 million transactions per hour. System capacity is determined based on tests with SPEI participants. On average, the system currently process about 1.5 million daily payments, with peaks of 4.8 million transactions which correspond to TESOFE disbursements. This excess capacity corroborates the conclusion that the system currently has a high degree of scalability. Banxico regularly monitors system’s volume of operations to identify trends. System program design is such that participants could not send more payment instructions than SPEI can process. This feature could delay the processing of a large payroll, for example. For these purposes, participants can schedule payment instructions beforehand (pagos programados) which would be generated through an independent process and out of the SPEI “alternate” SPEI account. SPEI does not use any incentives to direct the flow of payments throughout the operating day. Rather, it monitors capacity closely with a view to increase capacity as demand grows. It is understood that there are plans to increase capacity in the next few years using parallel processing to enhance scalability of the system. SPEI is not versatile as it uses one server for several important processes. As a result, delays may occur as a result of other processes that may jeopardize (quasi) real-time settlement.

Key consideration 5 An FMI should have comprehensive physical and information security policies that address all potential vulnerabilities and threats.

Description Physical security Banxico physical security is the responsibility of the Directorate of Security, under the Directorate General of Currency Issuance. Physical security measures are defined in Internal Administrative Rules on entry and exit into/from Banxico’s buildings. This document establishes the requirements for accessing high-security facilities, the entry and exit of personnel, suppliers, and contractors into/from these facilities. Likewise, there is restricted access to the following areas: electrical room, emergency generators, communication networks, and data center, among others. Information security

58

Banxico’s information security policies are aligned with ISO/IEC 27001. IT security measures have been established in the Internal Administrative Rules on Information Technologies. These rules define general criteria for the design, implementation, and management of central bank-provided IT services. In particular, it defines the change management process for IT services as well as IT security management, e.g. access control, incident management, firewalls, etc. SPEI files whose content is deemed sensitive are encrypted to protect their content. Digital signatures are used that ensure the authenticity of the information and that the sender cannot repudiate a payment instruction once this has been sent. Participants are connected to the system through a virtual private network (VPN) that uses encrypted communications. Participants are expected and instructed to provide evidence of compliance with a number of IT and information security requirements. SPEI information security policies on authentication, signature, and encryption are based on the following international standards: (i) X. 509v3 (RFC 3280) for certificates’ formats; PKCS #1 (RFC 2313) for RSA-type private keys; PKCS #1 standard for the creation of digital signatures and validations.

Key consideration 6 An FMI should have a business continuity plan that addresses events posing a significant risk of disrupting operations, including events that could cause a wide-scale or major disruption. The plan should incorporate the use of a secondary site and should be designed to ensure that critical information technology (IT) systems can resume operations within two hours following disruptive events. The plan should be designed to enable the FMI to complete settlement by the end of the day of the disruption, even in case of extreme circumstances. The FMI should regularly test these arrangements.

Description Objectives of business continuity plan SPEI business continuity is supported in the Business Continuity Management System (BCMS) whose overall objective is fulfill Banxico’s responsibility to ensure the operational continuity of the payment systems it operates. The BCMS is aligned with international standards, namely ISO 22301:2012. The specific objectives of the BCMS are to (i) ensure the operational continuity of, and mitigate the negative impact on central bank-operated payment systems in case of a disruptive event through the implementation of efficient and effectives controls and procedures; (ii) validate the correct functioning of, and improve as appropriate business continuity procedures through capacity building, awareness raising, and testing,

59

and; (iii) validate the correct functioning of, and improve as appropriate the emergency response and recovery plans. The scope of BCMS includes all DSP-operated payment systems and services. In this context, Banxico has developed a business continuity plan (BCP) for DSP-managed systems. Its main objective is to ensure systems’ recovery in case of disruption or disaster that may affect the provision of DSP critical services through the implementation of business continuity procedures to maintain minimum acceptable service levels. The BCP builds on the BIA and the comprehensive risk management framework (see Principle 3). Design of business continuity plan The BCP aims to ensure continuous operation through the identification of business continuity measures for each of the identified contingency scenarios: (i) in case of unavailability of the primary facilities due to

external factors, operations will be moved to the secondary site (operacion en sitio alterno, SOA);

(ii) in the event of the primary servers being compromised due to hardware, software, or communication malfunction, the procedure for switching operations to secondary servers will be initiated;

(iii) should the personnel in charge of the operation, administration, and support of the system(s) be unable to reach Banxico primary or secondary facilities, the system can be operated remotely, e.g. through portable equipment provided by Banaxico;

(iv) the impact of a virus or malware attack on Banxico’s primary work stations is mitigated through a protected network of work stations (estaciones de trabajo fortalecidas, ETFs), and;

(v) In the imminent threat of a prolonged interruption of any system applications that could not be resolved otherwise, Banxico will invoke the Alternate Operation Procedure (Procedimento de Operacion Alterno, POA), a semi-automated procedure that allows continuous processing of payment instructions in POA-SPEI format.

Finally, the protracted unavailability of the participants’ applications could result in the activation of the Client Alternate Operation Procedures (COAS) within 15 to 120 minutes from the disruptive event, depending on the time of the day when the contingency occurs. SPEI recovery time has been set to 30 minutes. The overall recovery time objective (RTO) is tested at least annually. The RTO is prescribed in Banxico’s institutional work plan and reported regularly to the Board of Governors.

60

Real-time data synchronization is available for the secondary site, practically eliminating the potential of data losses. Data is also replicated asynchronously to a third site (see below). Other redundancies that secure continuous operations include main site equipment, dual external power and communication suppliers, dual operating systems, as well as participants’ redundant infrastructures. Banxico (DSP) has developed an incident and emergency response procedure (Procedimiento de Atencion a Incidentes y Respuesta a Emergencias) that, among other aspects, establishes the communication tree whose effectiveness is ensured through testing. Banxico’s Business Continuity Committee also has protocols in place for crisis management that include the communication flow between Banxico’s administrative units. Secondary site Banxico has established a hot secondary site. This is located at a sufficient geographic distance (11 kilometers) from the primary site such that it has a distinct (e.g., seismic) risk profile. There is also a (warm) third site is located in Monterrey, in the northeastern state of Nuevo León. The third site will migrate to hot by the third quarter of 2016. The BCP considers a scenario in which the primary site becomes unavailable (see above) and provides additional guidance on the steps to be undertaken to access and use the secondary site’s premises and facilities. Review and testing SPEI’s readiness to operate as expected in the event of a disruption – e.g. unavailability of the primary facilities or computing infrastructure failure – is tested according to an agreed schedule between the operations and support personnel. Change management guidelines establish that whenever a change in SPEI’s production environment is required this is tested. The BCP was revised three times since it was issued in 2013. The BCP itself establishes the circumstances that warrant the plan’s revision or update; otherwise, the plan is reviewed on an annual basis.

Key consideration 7 An FMI should identify, monitor, and manage the risks that key participants, other FMIs, and service and utility providers might pose to its operations. In addition, an FMI should identify, monitor, and manage the risks its operations might pose to other FMIs.

61

Description Risks to the FMI’s own operations Banxico regularly identifies and monitors the operational risks arising from other FMIs and DSP-managed systems, particularly SIAC. As far as SIAC is concerned, its unavailability would affect start- and end-of-day operations as well as intraday liquidity provision to banks by means of collateralized overdrafts. To manage the risks inherent to this connection, Banxico has an alternate procedure to manually transfer funds between the systems. More broadly, through the BIA and in conjunction with the Comprehensive Risk Management Framework, Banxico ensures that the impact on SPEI of a possible disruption in an interconnected FMI/system is measured and accounted for in the definition of DSP-wide and SPEI-specific business continuity measures. Banxico’s analysis of interdependencies does not explicitly cover the risks that a disruption in DALI would pose to SPEI. Nonetheless, in its role as participant of SPEI, DALI is subject to operational risk requirements that include disaster preparedness and redundant infrastructure. Further, COAS would be activated in the event of a problem in DALI’s applications. Finally, Banxico has developed a Contingency Manual for Operations with CLS Bank International. Through redundancy of communication and power infrastructure, SPEI is prepared for possible service interruptions. Contracts with SPEI telecommunication and software suppliers enforce certain level-service agreements, particularly with regard to service availability, recovery time after service interruption, and response time. Risks posed to other FMIs Banxico regularly identifies the operational risks that it poses to other FMIs and DSP-managed systems, namely SIAC, APLSPEI, and CLS, as well as SPEI participants and DALI. As far as DALI is concerned, similarly to what explained above, the interconnected FMI is also a SPEI participant and as such business continuity arrangements are highly integrated.

Key conclusions Banxico has established best practices and standards for the management of operational risks incurred in SPEI. Banxico’s policies and procedures are comprehensive and adequately documented, and specific plans have been developed to address the identified risks.

62

Banxico has clearly defined operational reliability objectives for the services it provides through SPEI that are in line with broader institutional objectives. SPEI’s capacity is adequate to current volumes and sufficiently scalable to cover increasing stress volumes. However, SPEI’s infrastructure is not versatile as it uses one server for several important processes, thus potentially compromising (near) real-time settlement. Banxico places a strong emphasis on continuity and information security. The former is ensured through redundancy of infrastructures, and relies on POA, SOA, as well as COAS procedures. Moreover, at 30 minutes, SPEI’s recovery time is well below the two-hour limit established by international standards. In terms of information security, Banxico has aligned institutional information security policies with ISO/IEC 27001. SPEI’s transactions are digitally signed and communications are encrypted. To the extent that interdependent FMIs are either operated by Banxico (i.e. SIAC) or act as a participant in SPEI (e.g. DALI), business continuity arrangements are highly integrated.


Observed


Banxico should consider establishing service-level targets for SPEI main services (e.g. processing speed) as opposed to CASP only, and in addition to system availability and recovery time targets. SPEI capacity planning should aim to achieve a sufficient level of confidence that service-level objectives (e.g. required processing speed) will be maintained under a wide range of plausible stress scenarios.

63

PRINCIPLE 18. ACCESS AND PARTICIPATION REQUIREMENTS An FMI should have objective, risk-based, and publicly disclosed criteria for participation, which permit fair and open access. Key consideration 1 An FMI should allow for fair and open access to its services,

including by direct and, where relevant, indirect participants and other FMIs, based on reasonable risk-related participation requirements.

Description Participation criteria and requirements SPEI regulations, art. 2 lists the types of entities that can participate in the system. These include credit institutions, broker-dealers, exchange bureaus, pension funds, insurance companies, savings and credit cooperative associations, mutual fund distribution entities, mutual fund management companies, and regulated finance companies, in addition to central securities depositories and clearinghouses authorized by Banxico according to the terms of the LTOSF. Banxico reserves the right to grant access to the system to any other entity provided that this is regulated and supervised by Banxico itself, the CNBV, CONSAR (Comisión Nacional del Sistema de Ahorro para el Retiro) or the CNFS (Comisión Nacional de Seguros y Fianzas). The prospective participant must demonstrate that it complies with the technical requirements to operate in SPEI. SPEI regulations establish participants’ obligations to comply with operating hours, protocols, formats, and processes established in the SPEI Manual. Participant must enter in a contract with Banxico. As far as information security and operational risk management are concerned, Banxico has issued specific requirements. Participants must provide the documental evidence of the risk management measured required by Banxico. Access to trade repositories Not applicable.

Key consideration 2 An FMI’s participation requirements should be justified in terms of the safety and efficiency of the FMI and the markets it serves, be tailored to and commensurate with the FMI’s specific risks, and be publicly disclosed. Subject to maintaining acceptable risk control standards, an FMI should endeavour to set requirements that have the least-restrictive impact on access that circumstances permit.

Description Justification and rationale of participation criteria Participation requirements are focused on (i) regulation/supervision as a prerequisite, and (ii) Banxico’s determination that the participant has the necessary technical requirements to operate safely in the SPEI. The admissible categories of participants are listed in art. 2 of the SPEI Rules. Banxico can admit new types of participants, provided that these are

64

regulated and supervised. New types of participants must be vetted and approved by the Board. SPEI participants’ contract requires that participants meet technological requirements (hardware/software) consistent with SPEI technical specifications. Least restrictive access In terms of proportionality, it is worth noting that certain more stringent requirements on service availability to the final customer are waived for smaller participants. In particular: • participants that have less than 1,500 customer accounts and

provide mobile transfer services to their customers, are exempted from the requirement to make available and process mobile transfers 24 hours 7 days a week; on the other hand, they must guarantee this service during business days, between the hours of 6:00 and 17:30.

• similarly, between the hours of 17:31 to 05:59, participants that have less than 1,500 customer accounts are exempted from the requirement to credit the account of the beneficiary of a mobile transfer within 5 seconds from being notified of the settlement of the transaction.

• the 10 second time limit established for refunds (devoluciones) is also not applicable to participants that have less than 1,500 customer accounts outside of normal business hours as referenced above.

SPEI annual fixed fee is determined according to the relative participation in the system of each participant based on the number of transactions initiated in the last five years. Banxico indicates that SPEI fees have decreased over time and do not represent a barrier to entry. Participants satisfying the participation criteria may access SPEI services without any restrictions. When considering access to intraday liquidity through SIAC, Banxico by law can only grant credit to banks (in addition to the Federal Government and IPAB) (see Banco de Mexico’s Law, art.7 II). Repos are extended to broker-dealers through banks (see Circular No. 3/2012). Disclosure of criteria SPEI regulations are publicly disclosed on Banxico’s website. The Operating Manual, contracts, and other documents that elaborate further on the requirements set out in art. 2 of the SPEI Rules are confidential in nature and disclosed only to system’s participants.

Key consideration 3 An FMI should monitor compliance with its participation requirements on an ongoing basis and have clearly defined and publicly disclosed procedures for facilitating the suspension and

65

orderly exit of a participant that breaches, or no longer meets, the participation requirements.

Description Monitoring compliance Prospective participants must undergo a process of certification. In light of changes that may occur in the infrastructure participants use to operate through SPEI, Banxico can require that a new certification is undertaken to ensure that SPEI requirements continue to be met. The process to monitor SPEI participants’ compliance is largely drawn from Banxico’s supervision rules (Reglas de Supervisión, Programas de Autocorrección y del Procedimiento Sancionador, 2015). Banxico supervisory approach is focused on: (i) monitoring and analysis of compliance based on the information supervised entities provide to Banxico, and; (ii) on-site inspections to verify operations and review records, systems, and facilities of supervised entities. When Banxico identifies a situation of non-compliance as a result of an inspection, it notifies the relevant parties and recommends corrective actions to be implemented by a deadline established by Banxico. The supervised entity submits a remediation plan. Banxico follows up on a remote basis through documental evidence of progress in implementing the remediation plan, or through on-site visits. On average, Banxico inspects a representative sample of ten SPEI participants every year. Participants’ compliance with information security and operational risk requirements are monitored through documental evidence and in-site inspections. SPEI contract also specifies the sanctions that apply in case of non-compliance with SPEI rules. Upon identifying a case of non-compliance, Banxico issues a notification to the participant, including the applicable fines. The participant has three working days to provide clarifications. On the fifth day, the participant must pay the fine. Suspension and orderly exit SPEI regulations establish that Banxico may suspend or terminate, at any time, SPEI operations with one or more participants when in the opinion of Banxico itself the participant may generate risks to the operation of the system, or when it breaches SPEI internal rules or contractual obligations (see art. 11.9). The Board of Governors is informed of participants’ (entry) and exit.

Key Conclusions SPEI rules and the faculties of Banxico in terms of allowing new categories of participants are broad enough to accommodate existing and foreseeable new needs that may arise in the Mexican financial market. Participation requirements are risk-based and justified in light of the systemically important nature of the system. However, these requirements are not publicly disclosed beyond a general requirement

66

for prospective participants to certify, at Banxico’s discretion, their technical preparedness to operate in the system. Although Banxico’s powers to suspend or terminate a participant are clear, there are no clearly defined and publicly disclosed procedures for facilitating the suspension and orderly exit of a participant that breaches, or no longer meet, SPEI participant requirements.

Assessment of principle 18

Broadly Observed


Banxico should compile and disclose the risk-based participation requirements in SPEI. Additionally, Banxico should define and publicly disclose procedures for facilitating the suspension and orderly exit of a participant that breaches, or no longer meet, SPEI participant requirements.

67

PRINCIPLE 19. TIERED PARTICIPATION ARRANGEMENTS An FMI should identify, monitor, and manage the material risks to the FMI arising from tiered participation arrangements. Key consideration 1 An FMI should ensure that its rules, procedures, and agreements

allow it to gather basic information about indirect participation in order to identify, monitor, and manage any material risks to the FMI arising from such tiered participation arrangements.

Description Tiered participation arrangements Not applicable. SPEI only allows direct participation. Risks to the FMI Not applicable. SPEI only allows direct participation.

Key consideration 2 An FMI should identify material dependencies between direct and indirect participants that might affect the FMI.

Description Not applicable. SPEI only allows direct participation. Key consideration 3 An FMI should identify indirect participants responsible for a

significant proportion of transactions processed by the FMI and indirect participants whose transaction volumes or values are large relative to the capacity of the direct participants through which they access the FMI in order to manage the risks arising from these transactions.

Description Not applicable. SPEI only allows direct participation. Key consideration 4 An FMI should regularly review risks arising from tiered

participation arrangements and should take mitigating action when appropriate.

Description Not applicable. SPEI only allows direct participation. Key conclusions - Assessment of Principle 19

Not applicable


-

68

PRINCIPLE 21: EFFICIENCY AND EFFECTIVENESS An FMI should be efficient and effective in meeting the requirements of its participants and the markets it serves. Key consideration 1 An FMI should be designed to meet the needs of its participants

and the markets it serves, in particular, with regard to choice of a clearing and settlement arrangement; operating structure; scope of products cleared, settled, or recorded; and use of technology and procedures.

Description SPEI design and operation are based on best practices and international standards, including (near) real-time settlement, and a multilateral netting mechanism that optimizes liquidity in conjunction with other tools that facilitate participants’ liquidity management. SPEI supports straight-through-processing (STP). It operates through an open communication protocol that allows participants to connect to SPEI seamlessly regardless of the programming language and operating system used. Over time, Banxico has improved SPEI to meet the evolving needs of its participants and the financial market, as well as the individual beneficiaries / bank customers. For example: (i) it has added new payment types (it currently supports 15 such types of payment); it underpins the digitalization of government disbursements by processing the equivalent of MXN 245 trillion or 335 million operations initiated by TESOFE every year; (iii) it has implemented a system of notification about the status of payments to the final beneficiaries accessible through Banxico’s website – Comprobante Electronico de Pago, CEP (http://www.banxico.org.mx/cep/), and; (iv) it has increased operating hours to achieve interoperability of mobile payments. De facto participants are notified, and consulted about system’s changes prior to their implementation, although through ad hoc rather than formal, permanent mechanisms. Banxico maintains a help desk (Centro de Atención de los Sistemas de Pagos, CASP) for users’ (internal, i.e. Banxico personnel and external, i.e. financial institutions staff) support comprised of eight staff.

Key consideration 2 An FMI should have clearly defined goals and objectives that are measurable and achievable, such as in the areas of minimum service levels, risk-management expectations, and business priorities.

Description Within the broader mandate of ensuring the smooth functioning of the payment systems, Banxico has defined a clear objective to strengthen the operational risk management of central bank-operated system to ensure business continuity. As noted in Principles 2 and 17, these objectives are measured through two indicators on (i) payment system availability, and (ii) recovery time.

http://www.banxico.org.mx/cep/

69

SPEI contributes to Banxico’s objective to promote the use of electronic payment instruments (see Principle 2), as measured through the number of electronic payments as a share of total payments.6 Banxico has established service-level agreements (SLAs) with regard to the support services provided by the CASP. Among other aspects, SLAs regulate response time, e.g. it is established that 90 percent of users’ queries must be attended within ten minutes, whereas 70 percent of incidents must be resolved between 20 minutes and 1 hour depending on the level of priority assigned. Banxico tracks participants’ satisfaction with CASP’s services through surveys. SPEI pricing policy is based on full recovery of operating costs. Participant fees are re-calculated each year based on Banxico’s estimation of SPEI operating costs.

Key consideration 3 An FMI should have established mechanisms for the regular review of its efficiency and effectiveness.

Description The DSP prepares quarterly progress reports against the SPEI work plan that are reviewed by the senior management. The outcomes are reported to the Governor annually or more frequently as appropriate. Similarly, system availability and recovery time indicators are monitored on a quarterly basis and reported annually to the Governor and the Board of Governors. SPEI undergoes internal and external audit on a number of aspects of its operations multiple times a year.

Key conclusions SPEI was developed to replace the previous Banxico-operated system, which resulted in enhanced risk management and greater efficiency. Since its creation, Banxico has been effective in accommodating the payment and settlement needs of Mexican financial institutions, and it proactively sought market development opportunity (e.g. through interoperability of mobile payments). There are a number of (mostly informal) mechanisms in place to promote, together with market participants, the ongoing improvement of SPEI. All participants interviewed have confirmed that the system meets their needs and shared positive feedback. Non-bank financial institutions report to have benefited greatly from direct access to

66 The number of electronic payments is calculated as the sum of the number of electronic funds transfers, SPEI customer-to-customer transactions (tercero a tercero), direct debits, payment card transactions, and intra-bank transactions. Total number of payments is calculated as the number of electronic payments plus cheques and cash withdrawals.

70

the payment system, particularly in terms of cost-savings. At the same time, it is perceived that access to consultation and decision-making processes is skewed towards the majority participants. SPEI’s pricing policy is to recover operational costs in full.


Broadly Observed


While Banxico has been generally responsive to market needs, the project to establish a more formal and structured feedback mechanism through a Users’ Group or similar mechanism with broad participation (i.e. with representatives from all categories of participant) is encouraged. Among other objectives, this would help ensure that multilateral discussions are held regularly and that these discussions reflect the views and opinions of a significant share of its participants, that the initiatives are prioritized based on consensus, and that there is adequate follow-up to the various initiatives. To the extent that SPEI processes low-value payments, of which most are customer-to-customer interbank transactions – in fact, these payments represent the second most important payment type by volume with over 52 million transactions between January and March 2016 – Banxico should consider establishing and tracking indicators of usage and cost-efficiency of SPEI for customer of banks as part of the formal mechanism for the regular review of the system’s efficiency and effectiveness. Banxico should complete and publish the CPMI-IOSO Disclosure Framework for SIAC with the objective to enhance transparency on the services provided by Banxico through SIAC that have a direct bearing on SPEI’s operations.

71

PRINCIPLE 22: COMMUNICATION PROCEDURES AND STANDARDS An FMI should use, or at a minimum accommodate, relevant internationally accepted communication procedures and standards in order to facilitate efficient payment, clearing, settlement, and recording. Key consideration 1 An FMI should use, or at a minimum accommodate,

internationally accepted communication procedures and standards.

Description Communication procedures SPEI uses a proprietary communication network for the exchange of data with its participants. Communication standards SPEI uses a proprietary message protocol for data communication with its participants. SPEI protocol is not an international standard. To communicate with CLS Bank, Banxico has a tool that translates messages from SPEI format to SWIFT and vice-versa. SPEI protocol is also capable of translating SPEI format to SWIFT and vice-versa for processing banks’ For Further Credit transactions.

Key conclusions Banxico does not use internationally accepted communication procedures and standards. However, conversions from/to SWIFT is made in a relatively straightforward manner.


Observed


It is recommended that Banxico evaluate on a regular basis the opportunity to migrate to internationally accepted communication standards. This issue is a candidate topic for discussion and consultation in the context of the envisaged / recommended participants’ forum. It is understood that the cost-efficiency implications of migrating to an international standards are not straightforward for a system such a SPEI with a highly diversified participation and high volumes of low-value transactions, e.g. customer-to-customer payments. Moreover, SPEI protocol has been a factor in achieving broad participation and in facilitating straight-through-processing.

72

PRINCIPLE 23: DISCLOSURE OF RULES, KEY PROCEDURES, AND MARKET DATA An FMI should have clear and comprehensive rules and procedures and should provide sufficient information to enable participants to have an accurate understanding of the risks, fees, and other material costs they incur by participating in the FMI. All relevant rules and key procedures should be publicly disclosed. Key consideration 1 An FMI should adopt clear and comprehensive rules and

procedures that are fully disclosed to participants. Relevant rules and key procedures should also be publicly disclosed.

Description Rules and procedures The SPEI Rules (Circular No. 17/2010) and SPEI Operating Manual represent SPEI’s key rules and procedures. The clarity of SPEI rules is ensured through legal analysis prior to amending existing regulations or issuing new regulations. Participants’ feedback and understanding of the rules is also gathered through ad-hoc meetings, as well as in the context of participants’ supervision. Disclosure The SPEI Rules is a public document available through the Official Gazette of the Federation and Banxico’s website. The Operating Manual contains classified information; therefore it is made available only to participants and to other interested parties through the appropriate communication channels. The Manual and other internal documents provide information on the procedures that Banxico will follow, including discretionary actions, in non-routine or critical events. De facto, participants are notified of, and consulted about, material changes in SPEI rules that would affect their operations. However, at present there is no formal requirement for Banxico to engage in consultations with its participants for this purpose.

Key consideration 2 An FMI should disclose clear descriptions of the system’s design and operations, as well as the FMI’s and participants’ rights and obligations, so that participants can assess the risks they would incur by participating in the FMI.

Description SPEI Operating Manual includes detailed information about the system’s design and operations. The Manual is a confidential document available to participants and other relevant parties only. Nonetheless, Banxico has published information on its website about the main features of SPEI as well as information directed to users. Participants’ rights and obligations can be derived by SPEI Rules, in conjunction with the Manual and the contracts. SPEI rules generally refer to an obligation to certify at Banxico’s discretion their technical preparedness to participate in the system.

73

The SPEI Rules, the Manual and the contracts describe the cases and areas in which Banxico may exercise discretion (e.g. contingencies) and the approach it will follow in such circumstances. It is worth noting that

Key consideration 3 An FMI should provide all necessary and appropriate documentation and training to facilitate participants’ understanding of the FMI’s rules and procedures and the risks they face from participating in the FMI.

Description Upon becoming a SPEI participant, financial institutions are provided with the relevant rules and procedures, including the SPEI Operating Manual. Prior to amending rules and procedures, Banxico notifies the system participants. In addition, Banxico provides a support desk (see Principle 21) and a window for participants/users to provide comments and request clarifications. Banxico may engage in a one-off meeting/training as necessary. The means described above are generally sufficient to ensure a participant’s good understanding of the rules, procedures and the risks they face from participating in SPEI.

Key consideration 4 An FMI should publicly disclose its fees at the level of individual services it offers as well as its policies on any available discounts. The FMI should provide clear descriptions of priced services for comparability purposes.

Description SPEI pricing policy is disclosed in the SPEI Rules. Art. 11.4 lays out the fee components, i.e. an annual fixed fee and a monthly variable fee. The fixed fee is determined according to the criteria disclosed in the Rules (art. 11.4 (a)), i.e. (i) Banxico’s determination of the overall operating costs of the system, which include in addition to system operation and maintenance, new product and project devolpment and system upgrades, and; (ii) the relative participation in the system as measured by the number of payment orders sent over a period of five years as a proportion of total payments processed in the system in the same period. The fixed fee thereby calculated has a one-year validity. Variable fee components are listed in the Annex to the SPEI Rules, and correspond to CLS payments, transfers between accounts, refund orders, and retransmitted information. Each financial institution is notified of its charges.

Key consideration 5 An FMI should complete regularly and disclose publicly responses to the CPSS-IOSCO disclosure framework for financial market infrastructures. An FMI also should, at a minimum, disclose basic data on transaction volumes and values.

Description The disclosure framework The SPEI Disclosure Framework is dated March 2016. It is established that this document should be updated every two years or in case of significant changes to SPEI’s design and operations. This document is available on Banxico’s website in Spanish. (http://www.banxico.org.mx/sistemas-de-pago/material-educativo/intermedio/evaluaciones-conforme-a-las-mejores-practicas-inte/conforme-a-las-mejores-practicas-

74

internacionales/%7BDE853D65-8859-1D34-76EE-0ECF98065A59%7D.pdf) Banxico publishes monthly statistics on the volumes and values of transactions (http://www.banxico.org.mx/sistemas-de-pago/index.html#E). On a daily basis, it publishes statistics on participants’ connections (http://www.banxico.org.mx/monspei/#todos).

Key conclusions Banxico makes extensive disclosure of its rules, key procedures and fee structure to SPEI participants. Disclosure to the public in general is satisfied through the CPMI-IOSCO Disclosure Framework and the Banxico’s website. While Banxico engages in consultations with its participants on a need basis, the consultation process is not formalized, for instance in the Manual. Likewise, the Operating Manual does not describe the process that Banxico shall follow in order to inform its participants of any changes to services and fees. Although there is no training program as such, the level of information and participants’ understanding of the systems’ rules and procedures is deemed adequate. Banxico has put in place a certification procedure, and to some extent participants’ supervisory practices that allow reinforcing participants’ understanding of the risks they incur. Variable fees are attached to the SPEI Rules. Fixed fee are dependent upon Banxico’s determination of its operating costs and the volumes transacted. Banxico recently prepared a disclosure framework based on the CPMI-IOSCO format and made it available on its website in Spanish and English.


Observed


Although in practice Banxico provides timely notice to participants of material changes in SPEI rules and procedures that may affect participants’ operations, it should include in its rules a clear obligation to do so with respect to both changes in rules and fees. Similarly, it should specify and formalize the process for consulting SPEI participants and other relevant parties as appropriate about the proposed changes. Among other aspects, it should establish the timeline of the consultation process and the tools that will be used for obtaining participants’ feedback. Finally, Banxico could consider increasing transparency on SPEI operating costs as a basis for the calculation of the annual fixed fee.

VI. BANCO DE MEXICO’S RESPONSE TO THE ASSESSMENT

public disclosure authorized - world bankdocuments.worldbank.org/curated/en/... · comprobante...

Documents