Regulation aims to strengthen anti-fraud systems in banks

In order to strengthen anti-fraud guidelines within banking institutions, the National Banking and Securities Commission (CNBV) is implementing one of its most ambitious provisions in recent years, which requires banks in Mexico to have better controls to prevent and investigate fraud against their customers.

According to data from the National Commission for the Protection and Defense of Financial Services Users (Condusef), from January to September 2024, 4.9 million complaints had been registered by bank customers, of which 73% corresponded to possible fraud.

In view of these figures, in June 2024 the authority published the new regulation, in order for banks to strengthen their controls in terms of prevention, detection and timely response to fraud.

According to an analysis by specialist consultants in banking regulation, Samantha Beltrán and Rafael Valencia, as a first step of this regulation, is the preparation and presentation of a Fraud Management Plan, which should cover aspects such as the implementation of robust internal controls to prevent and detect fraud, verification of customer identity, monitoring and detection of unusual operations via automated systems, internal training and audits.

"The regulation contemplates the minimum guidelines for the fraud prevention management plan, that is, the actions and internal controls that financial institutions must implement to mitigate fraud risks," the analysis reads.

According to the analysis, the provisions introduce new figures such as the security officer, the fraud management committee, the person responsible for fraud prevention, detection system, communication channels, operations with digital identification, among others.

You may be interested in

Conduct that will be prosecuted

Mary Pily Loo Castillo, general director of Operational and Technological Risk at the CNBV, indicated that the purpose of this regulation is to have guidelines to detect, prevent and investigate specific conducts such as identity theft, data theft, institutional impersonation, misuse of privileged information, malware attacks and alteration or issuance of fake checks.

"We have identified that all of a sudden they make calls to the client, have their data and sensitive information, by people who are not authorized to do so. It contemplates the obligation to investigate how these people got hold of that privileged information," stated Loo Castillo.

The new rules provide for deadlines for the implementation of the provisions, since, for example, banking institutions had until December 2024 to submit the management plan for fraud prevention and until April of this year for its implementation.

Likewise, these obligations establish that, by October of this year at the latest, financial institutions must adapt their branches for the installation of partitions to reinforce security for their customers.

Another aspect that institutions must comply with is the implementation of an interbank communication channel, where banks can share information regarding their own employees accused of fraud. This mechanism will come into effect as of October 1.

This new regulation will be reflected in the relationship between banks and their customers, since as of October 1, the concept of User Transaction Amount will be applied, which in the first instance must be determined by the user himself and will be used to detect transactions that deviate from the usual parameters of its use and, if necessary, to prevent fraud.

The regulation only applies to multiple and development banks, with different deadlines for its implementation, which would end in 2027.

[email protected]