Operational Risk

The Institution has an organizational model that allows communication between the three lines of defense to be able to mitigate risks reasonably through the implementation and execution of internal controls.

The Institution has a solid maturity in operational risk management represented by:

Process capacity: Standardized and communicated.
Staff competence: compliance with the position-person profile, Trained and Evaluated in their performance.
IT status: Technological applications interacting with each other, in order to ensure correlation between the processes involved.
Management of the First Line of Defense, Supervision of the Second Line of Defense, and Assessment of the Third Line of Defense.

The design and management of its Comprehensive Operational Risk Methodology consider the best practices in the matter:

Good practices for the management and supervision of operational risk, issued by the Basel Committee on Banking Supervision in February 2003.
ISO 31000:2018, issued by the International Organization for Standardization, provides the principles and guidelines for Risk Management.
ISO/IEC 31010:2019 - Risk Assessment Techniques, issued by the International Organization for Standardization and the International Electro Technical Commission (IEC).
ISO7IEC 27001, issued by the International Organization for Standardization that provides the principles and guidelines for Information Security Management.

Likewise, the following are monitored and reported monthly:

The Operational Risk Profile.
Strategic Risk Indicators to measure the evolution of each of the risks defined as priorities.
The stewardship carried out by the Critical Processes Owners regarding Risk scenarios.
Where appropriate, the Corrective Actions implemented by the Processes Owners regarding materialized events.
Capital Requirement by Operational Risk
Reserve for Operational Risk or Resource requirements for the protection of Issuing Clients of the Interbank Electronic Payment System (SPEI) by Banco de México.

As of December 2020, the estimated Operational Risk profile is at the tolerable level (5), and the occurrence of operational risk events is within the tolerance level. The Institution’s productivity under the Remote Work Model that was in place due to the health contingency, measured by monitoring the number of operations in national currency (MN) and foreign currency (ME) operated by the cash flow area, shows the number of operations exceeding the historical average. The Institution's operations were active under a controlled environment that favored customer service and the orderly and disciplined management of processes.