Financial Services Regulation 2025 Comparisons

In Mexico, financial regulation is generally divided into:

• federal laws;
• general rules (disposiciones de carácter general);
• regulations (Circulares); and
• special laws and regulations.

The key pieces of financial services legislation are as follows; please note that this list is intended to be illustrative and not exhaustive.

Laws

• The Ley de Instituciones de Crédito (“Banking Law”) is the primary law applicable to Mexican banks and foreign branches of banks (filiales) in Mexico. It outlines the requirements for the establishment, operation and supervision of banks in Mexico, and also includes provisions on allowed and prohibited transactions, corporate governance, risk management and consumer protection applicable to banks.
• The Ley de Instituciones de Seguros y Fianzas (“Law of Insurance and Bond Companies”) sets forth the requirements for the establishment, operation and supervision of insurance and bond companies in Mexico. It also includes provisions on allowed and prohibited transactions, corporate governance, risk management and consumer protection applicable to insurance and bond companies.
• The Ley de los Sistemas de Ahorro para el Retiro (“Law for Pension Systems”) sets forth the requirements for the operation, investment regime and supervision of the Mexican pension system, including provisions on allowed and prohibited investments, as well as requirements related to corporate governance and risk management.
• The Ley del Mercado de Valores (“Securities Market Law”) sets forth requirements for the establishment, operation and supervision of broker dealers, stock markets, investment advisers, credit rating companies and issuers, among other institutions. It also includes provisions on allowed and prohibited transactions with securities, as well as corporate governance, risk management and consumer protection provisions applicable to these institutions.
• The Ley de Protección al Ahorro Bancario (“Law for the Protection of Bank Deposits”) provides for a protection system for customers of the banking system, known as the Instituto para la Protección al Ahorro Bancario (IPAB), to ensure bank deposits are insured in case of concurso mercantil or bankruptcy.
• The Ley de Ahorro y Crédito Popular (“Popular Credit and Savings Law”) sets forth the requirements for the establishment, operation and supervision of Sociedades Financieras Populares (Popular Financial Companies) and Sociedades Financieras Comunitarias (Community Financial Companies). It also includes provisions on allowed and prohibited transactions, corporate governance, risk management and consumer protection.
• The Ley para Regular las Instituciones de Tecnología Financiera (“Fintech Law”) sets forth the requirements for the establishment, operation and supervision of e-wallets (instituciones de fondos de pago electrónico), crowdfunders (instituciones de financiamiento colectivo) and sandbox models (modelos novedosos) (together, “Fintech Companies”), as well as the requirements for transactions with virtual assets (activos virtuales). It also includes provisions on allowed and prohibited transactions for such entities and with such assets, as well as corporate governance, risk management and consumer protection provisions.
• The Ley de Protección y Defensa al Usuario de Servicios Financieros (“Law for the Protection and Defence of Financial Services Users”) focuses on the protection of financial service users. It establishes the rights of consumers and the obligations of financial institutions, including transparency and fair treatment.
• The Ley para la Transparencia y Ordenamiento de los Servicios Financieros (“Law for the Transparency and Order of Financial Services”) provides guidance and obligations for payment services providers and for institutions that grant credit, to ensure the transparency and efficiency of payment systems and protect the interests of the general public.
• The Ley para Regular las Agrupaciones Financieras (“Financial Groups Law”) provides for the establishment of financial groups in Mexico. Financial groups are formed by a financial holding company and its subsidiaries, which are regulated financial companies. Financial groups are regulated and supervised by different authorities in Mexico, depending on the entities that comprise them.

Regulations

• The Disposiciones de Carácter General Aplicables a las Instituciones de Crédito or Circular Única de Bancos (CUB or the “Banking Regulations”) is issued by the Comisión Nacional Bancaria y de Valores (the “National Banking and Securities Commission”, or CNBV), and contains most of the regulatory requirements applicable to banks in Mexico, including capital and liquidity requirements, corporate governance, financial reporting, risk management, operational requirements, technology requirements and the duties of senior management.
• The Disposiciones de Carácter General Aplicables a las Casas de Bolsa (the “General Provisions Applicable to Broker Dealers”, or CUCB) is issued by the CNBV and contains most of the regulatory requirements applicable to broker dealers in Mexico, including capital requirements, corporate governance, financial reporting, risk management, operational requirements, technology requirements and the duties of senior management.
• The Disposiciones de Carácter General Aplicables a las Instituciones de Tecnología Financiera (the “General Provisions Applicable to Financial Technology Institutions”, or CUITF) is issued by the CNBV and contains most of the regulatory requirements applicable to Fintech Companies, including capital requirements, corporate governance, financial reporting, risk management, operational requirements, technology requirements and the duties of senior management.
• The Disposiciones de Carácter General Aplicables a las Entidades de Ahorro y Crédito Popular, Organismos de Integración, Sociedades Financieras Comunitarias, y Organismos de Integración Financiera Rural, a que se Refiere la Ley de Ahorro y Crédito Popular (CUSOFIPO) is issued by the CNBV and contain most of the regulatory requirements for Popular Financial Companies and Community Financial Companies.

Regarding the supervision authorities of banks, the Ministry of Finance (Secretaría de Hacienda y Crédito Público, or SHCP) bears the primary supervisory responsibility and is supported by an autonomous agency functionally attached to it, the CNBV, which regulates banks, broker dealers and investment funds, among others. In addition to managing its normal central bank operations, Banco de México (“Banxico”) also regulates the deposit, lending and payment services and funding transactions of banks, as well as the foreign exchange and derivatives markets in Mexico.

Regarding Mexican authorities, the most relevant regulations are:

• the Law of the National Banking and Securities Commission (Ley de la Comisión Nacional Bancaria y de Valores); and
• the Law of the Mexican Central Bank (Ley del Banco de México).

The following products and services are regulated in Mexico (please note that this list is illustrative rather than exhaustive):

• banking services;
• derivatives;
• insurance and bond companies;
• retirement savings funds (AFOREs);
• public and private securities offerings;
• securities intermediation;
• e-wallets;
• crowdfunding;
• payment acceptance services;
• deposits; and
• foreign exchange transactions.

Certain financial services are exempt from regulation by Mexican authorities, including:

• granting credit or loans; and
• issuing credit or debit cards.

Crypto-assets are known in Mexico as “virtual assets” and are regulated through the Fintech Law and Banxico Regulation 4/2019.

Such regulations define a virtual asset as the electronic representation of value that is used by the general public as a means of payment for all sorts of legal transactions and whose transfer is only possible through electronic means. In general, neither local nor foreign currency, nor any other assets valued in local or foreign currency, are considered virtual assets.

Banks and Fintech Companies may only perform internal transactions when authorised by Banxico, and with the virtual assets that Banxico determines viable.

Transactions involving the purchase or sale of virtual assets are also considered vulnerable to money laundering. Therefore, any individual or company that performs such transactions, other than financial institutions, is required to comply with the obligations set forth in the Mexican Anti-Money Laundering Law.

The primary financial services regulators in Mexico are:

• the SHCP;
• the CNBV;
• Banxico;
• the Institute for the Protection of Bank Deposits (Institución de la Protección al Ahorro Bancario);
• the National Commission for the Protection and Defence of the Users of Financial Services (Comisión Nacional para la Protección y Defensa de los Usuarios de Servicios Financieros, or CONDUSEF);
• the National Commission for Insurance and Bond Companies (Comisión Nacional de Seguros y Fianzas, or CNSF); and
• the National Commission for the Retirement Savings System (Comisión Nacional del Sistema de Ahorro para el Retiro, or CONSAR).

Mexican regulators’ rules and guidance cannot all be found in one single location; Mexican authorities publish regulations, press releases, articles and other pieces of soft law relevant to financial institutions in the following sources.

• The official websites of each authority:
1. Congreso de la República (Mexican Congress): www.diputados.gob.mx;
2. SHCP: www.gob.mx/shcp;
3. Banxico: www.banxico.org.mx;
4. CNBV: www.gob.mx/cnbv;
5. CNSF: www.gob.mx/cnsf;
6. CONSAR: www.gob.mx/consar;
7. CONDUSEF: www.condusef.gob.mx; and
8. IPAB: www.gob.mx/ipab.
• The following websites also contain relevant regulations:
1. Normatividad CNBV (CNBV Regulations): www.cnbv.gob.mx;
2. Normativa CNSF (CNSF Regulations): www.gob.mx/cnsf;
3. Normatividad CONSAR (CONSAR Regulations): www.consar.gob.mx; and
4. Normateca del Instituto para la Protección al Ahorro Bancario (Regulations Library of the IPAB): www.gob.mx/ipab.

In terms of soft law, Mexican authorities seldom interpret Mexican regulations and publish their opinions through press releases or public documents. Most soft law is issued and received in private, through notices sent directly to financial institutions, so is not published nor available for public consultation.

When Mexican authorities do publish interpretations and other soft law, they are available through the following websites:

• Comunicados de Prensa y Boletines Digitales de la CNBV (CNBV Press Releases and Digital Newsletters): www.gob.mx/cnbv;
• Prensa CNSF (CNSF Press): www.gob.mx/cnsf; and
• Prensa CONSAR (CONSAR Press): www.gob.mx/consar.

Mexico has implemented the Basel III reforms within the Banking Regulations, which are binding for all Mexican banks. The provisions of Basel III have been included within this regulation as part of the obligations and requirements that Mexican banks are required to meet in order to operate in Mexico.

Mexico implemented the T+1 settlement cycle in May 2024, at the same time as the United States and Canada.

Certain financial services have rules related to ESG principles that are mandatory. AFOREs are required to include in their investment prospectuses how their investment strategy incorporates ESG factors and how these factors are applied to risk management.

In addition, the Mexican Financial Reporting and Sustainability Standards Board (Consejo Mexicano de Normas de Información Financiera y Sostenibilidad, or CINIF) issued the Financial Reporting and Sustainability Standards (Normas de Información Financiera y Sostenibilidad, or NIS), which have been mandatory since 1 January 2025 for entities that prepare financial statements in accordance with the Financial Reporting Standards of the CINIF, which includes financial institutions.

As far as is known, no enforcement actions have been taken against financial institutions with respect to ESG regulations. However, such regulations are relatively recent, so it remains to be seen whether Mexican authorities will conduct enforcement actions in connection therewith.

Currently, there are no regulations or guidance related to the use of AI in Mexico. This lack of regulation extends to the financial system.

In Mexico, the regulatory attitude towards fintech companies, products and services has changed drastically since 2019, when the Mexican congress passed and published the Fintech Law, which creates several new legal figures for rendering fintech services, including:

• e-wallets (Instituciones de Fondos de Pago Electrónico);
• crowdfunders (Instituciones de Financiamiento Colectivo);
• sandbox models (modelos novedosos); and
• virtual assets (activos virtuales).

Please note that the Fintech Law recognises only these institutions as fintech providers; any other services providers that label their products as “fintech” but are not authorised by the Mexican authorities are not considered for this guide.

In general, Mexican authorities have a positive outlook on fintech companies, with 86 Fintech companies having been authorised by Mexican authorities by the end of 2024.

The CONDUSEF is the authority in charge of protecting customers, and is regulated under the Law for the Protection and Defence of Financial Services Users. The CONDUSEF publishes certain information received from financial institutions, as well as educational tools, to assist customers in making the best decisions possible. Such protection extends to all customers, regardless of whether they are considered vulnerable or not.

The CONDUSEF also receives complaints against financial institutions from customers, and may subsequently begin a mediation process or, where applicable, may impose penalties against financial institutions.

Shadow banking is currently permissible in Mexico for certain financial services but is restricted for others, which are more strictly supervised.

Non-financial institutions are allowed to provide loans and credit without requiring a licence, registration or authorisation from the Mexican authorities. These activities include issuing credit cards. The private placement of securities, under certain requirements, can be performed by any person.

However, most financial services in Mexico are regulated, including investment banking, securities intermediation, payment systems and wallet services, and are thus allowed only for Mexican financial institutions.

The authorisation process in Mexico varies depending on the financial institution seeking authorisation, but the process can broadly be divided into:

• financial institutions that require an authorisation; and
• financial institutions that require a registration.

Authorisation

The process for financial institutions that require an authorisation is, generally, as follows.

• A company incorporated in Mexico, or a foreign entity that intends to incorporate an entity in Mexico, must request a meeting with Mexican authorities to present its project. Such meeting will give input on the view of the authorities.
• Simultaneously, with the help of local legal and business consultants, the necessary documents in terms of Mexican law should be drafted before the submission of the authorisation request. These documents include legal, business, financial, operative, compliance and technological manuals and processes.
• Once the initial authorisation request is submitted, Mexican authorities will send notices to the interested party, with comments and observations related to the documents submitted. These notices can be as many as the authorities deem necessary.
• Once the interested party has fulfilled all the requirements set by the Mexican authorities, an authorisation will be granted by such authorities. This initial authorisation is contingent on the interested party implementing the mechanisms outlined in its manuals. Such mechanisms will be audited by the Mexican authorities to ensure they are adequate for safeguarding the interests of the customers, as well as the Mexican financial system.
• The Mexican authorities will grant a second authorisation to begin operations once they have ensured that the interested party has duly implemented the mechanisms necessary for performing the services as the financial entity for which it requested the authorisation.

Registration

The process for financial institutions that require a registration is, generally, as follows.

• A company incorporated in Mexico, or a foreign entity that intends to incorporate an entity in Mexico, should draft the necessary documents in terms of Mexican law, with the help of local legal and business consultants, before the submission of the registration request.
• Once the initial authorisation request is submitted, Mexican authorities will send notices to the interested party, with comments and observations related to the documents submitted. These notices can be as many as the authorities deem necessary.
• Once the interested party has fulfilled all the requirements sent by the Mexican authorities, the registration will be granted by such authorities.

The timeline for an authorisation or registration varies drastically from financial institution to financial institution, as well as from interested party to interested party. As a reference, the process for relatively simple financial institutions (in terms of the products and services they render) can take as little as six to eight months, while the most sophisticated may take anywhere from 12 to 18 months.

Senior individuals within authorised financial services firms are subject to direct regulation. Before their designation as such, senior individuals (ie, the chief executive officer and officers within the two hierarchies directly below such officer) are required to prove their expertise, creditworthiness and reputation before the Mexican authorities can authorise their designation.

Once such officers are designated, they are not regulated directly but they are required to act within the boundaries of Mexican law. When officers are in violation of Mexican law, whether wilfully or through negligence, certain penalties can be directly imposed on such officers.

No material financial services reforms are currently expected for the Mexican financial system.