Mexico

Regulations

• Can financial institutions use AWS?

  Yes. Financial institutions in Mexico are permitted to use cloud services, provided that they comply with applicable legal and regulatory requirements, such as those described below. 

• Who are the financial regulators?

  The Comisión Nacional Bancaria y de Valores or “CNBV” (National Banking and Securities Commission) is Mexico's primary financial supervisory authority as it relates to the use of cloud services by banks and other financial institutions. The CNBV grants licenses, authorizations or registrations for all financial institutions, inspects, supervises and surveys financial activities in detail and is considered the principal financial regulatory agency dependent of the Executive branch of the Mexican federal government.

  The Banco de México or “Banxico” (Central Bank of Mexico) supervises banks and other financial institutions and issues general regulations and monetary policies.

  The Comisión Nacional para la Protección y Defensa de los Usuarios de Servicios Financieros or “CONDUSEF” (National Financial Consumer Protection and Defense Commission) regulates marketing and offering of services by financial institutions to the public, and also serves as a mediator of disputes between financial consumers and financial institutions.
  

• What regulations apply to financial institutions using AWS?

  Financial institutions in Mexico may be subject to a number of different legal and regulatory requirements when they use cloud services. Relevant regulations include:

  • Ley de Instituciones de Crédito (Credit Institutions Law) regulates banks and their transactions.

  • CNBV Disposiciones de Carácter General Aplicables a las Instituciones de Crédito (General Rules Applicable to Banks), commonly known as Circular Única de Bancos, is issued pursuant to specific obligations established in the Credit Institutions Law that provides general rules for banks.

  • Banxico Circular 3/2012 contains provisions applicable to transactions of credit institutions.

  Customers that have questions about the applicable regulations and guidelines, and how these may apply to their use of AWS services, can reach out to their account representative.

  Regulations are changing rapidly in this space, and AWS is working to help customers proactively respond to new rules and guidelines. AWS encourages its financial institutions customers to obtain appropriate advice on their compliance with all regulatory and legal requirements that are relevant to their business, and local regulations, guidelines and laws.

• Key considerations for financial institutions using AWS

  AWS is committed to offering customers a strong compliance framework and advanced tools and security measures that customers can use to evaluate meet, and demonstrate compliance with applicable legal and regulatory requirements.

  Financial institutions who are using or planning to use AWS services can take the following steps to better understand their compliance needs:

  1. Consider the purpose of the workload(s) under consideration and the relevant categories of data in order to anticipate which legal and regulatory requirements may apply.

  2. Assess the materiality or criticality of the relevant workload(s) in light of local requirements. For example, the CNBV requires financial institutions to obtain CNBV's approval for the use of cloud services provided by a third party such as AWS.

  3. Review the AWS Shared Responsibility Model and map AWS responsibilities and customer responsibilities according to each AWS service that will be used. Customers can also use AWS Artifact to access AWS’s audit reports and conduct their assessment of the control responsibilities.

  Customers who have further questions about how AWS services can enable their security and compliance needs, or who would like more information, can contact their account representative.

• Key data privacy and protection considerations for financial institutions using AWS

  Financial institutions in Mexico using AWS services should consider applicable privacy requirements included in the Federal Law for the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares or "LFPDPPP"), the Privacy Notice Guidelines (Lineamientos del Aviso de Privacidad), applicable recommendations and guidelines issued by the Mexican Data Protection Authority ("INAI") and the General Law for the Protection of Personal Data Held by Public Entities (Ley General de Protección de Datos Personales en Posesión de los Sujetos Obligados or "LGPDPPSO").

  AWS’s technical and organizational measures are consistent with the requirements of the LFPDPPP and the LGPDPPSO to protect personal data. More information is available in AWS's Mexico Data Privacy page.
  

  The AWS whitepaper, Using AWS in the Context of Common Privacy and Data Protection Considerations provides useful information to customers using AWS cloud services to store or process personal data.
  

  Many organizations in both the public and private sectors have data residency requirements, driven by legal and regulatory demands. With AWS Outposts you can bring the advantages of the cloud to your facility, while storing and processing data in your chosen location.
  

Resources