Regulatory Routes for New Fintech Players Entering the Mexican Market

Mexico’s financial ecosystem has opened dramatically to new players over the past decade, with global and regional fintech innovators now competing alongside established traditional institutions. Household names in digital finance – such as Nubank, Revolut and MercadoPago, among many others – are building on the country’s rapid adoption of mobile payments, e-commerce and digital credit. Domestic wallets and non-bank lenders are also scaling up, meeting consumer demand for simpler accounts, instant payments and flexible credit. All these developments have helped to reduce Mexico’s deficit in financial inclusion.

These new entrants have arrived through different legal avenues. Some have started out as Electronic Payment Funds Institutions (Instituciones de Fondos de Pago Electrónicos, or IFPEs) that issue and manage digital wallets and payments, while others have formed or acquired non-bank entities known as Sociedades Financieras de Objeto Múltiple (SOFOMs) that provide credit and related services, or popular financial institutions known as Sociedades Financieras Populares (SOFIPOs) that combine deposit-taking with retail lending under a tiered operating framework. A smaller but growing cohort has pursued full banking licences as commercial banks, known as Instituciones de Banca Múltiple (“banks”), enabling them to intermediate deposits at scale, offer broader services and integrate deeply with Mexico’s financial infrastructure.

This article will explain how these four alternatives (banks, SOFOMs, SOFIPOs and or IFPEs) compare in scope, regulation and strategic fit. It highlights why many serious players initially choose non-bank paths to enter the market, and why the ability to do more under the banking regime ultimately makes a bank licence the best route for those seeking long-term breadth, credibility and scale.

The preferred routes: what new entrants choose first

Unless they are either a bank established abroad or a very big player, new players rarely begin as banks. Instead, they choose narrower and faster paths.

IFPE for digital wallets and payments

The IFPE regime was designed specifically by the Fintech Law (Ley para Regular las Instituciones de Tecnología Financiera) for electronic payments, enabling institutions to issue, manage, redeem and transfer electronic funds, connect to payment systems, and operate through apps and online channels.

The authorisation process is substantial, but mainly made for payments. Once authorised, IFPEs may seek further approvals to operate in foreign currency wallets, cross-border transfers or virtual assets, or to rely on critical vendors and cloud or data providers.

IFPEs cannot pay interest on deposits, and their ability to fund loans is restricted. IFPEs are also required to comply with strict anti-money laundering and counter- terrorism financing (AML/CFT) obligations in order to obtain their IFPE licence. Such obligations include:

• drafting and implementing an AML/CFT manual, which must include an assessment with a risk-based approach;
• drafting know-your-customer (KYC) policies to adequately identify customers;
• designating a compliance officer who is duly certified by Mexican authorities;
• drafting an assessment to classify customers based on their risk degree;
• having an internal communications and control committee to supervise the activities of the compliance officer and the compliance department;
• implementing procedures to vet employees and procedures to train employees on the obligations of the IFPE, as well as their personal obligations relating to AML/CFT matters;
• implementing an automated system that allows the IFPE to monitor customers’ transactions, issue alerts when certain thresholds are exceeded, and build a customer transactional profile;
• reviewing the blocked persons list before executing any agreements with potential customers; and
• delivering the reports required for cash transactions, international transactions, transactions with virtual assets, unusual transactions and internal concerning transactions (together, the “AML/CFT Obligations”).

SOFOM for credit-first models

SOFOMs are created under the Ley General de Organizaciones y Actividades Auxiliares del Crédito (the “Ancillary Law”) and specialise in lending and related activities such as factoring and leasing. They exist in regulated and non-regulated forms. A non-regulated SOFOM (ENR) offers operational flexibility to launch credit products quickly, while a regulated SOFOM (ER) operates within the banking group framework and follows for stricter oversight.

For retail or merchant-focused lenders, SOFOMs are a natural entry point for issuing loans, cards linked to credit lines, or payroll products. SOFOMs cannot take deposits and are funded by obtaining loans or by issuing securities.

Before obtaining the licence to operate as a SOFOM, such entities are required to request a favourable opinion from the CNBV with respect to their AML/CFT obligations. Such opinion is issued by the CNBV once it ensures that the SOFOM complies with the AML/CFT Obligations; however, SOFOMs are not required to have a certified compliance officer and may designate a member of the communications and control committee as such.

SOFIPO for deposit-and-credit retail models

SOFIPOs are created by the Ley de Ahorro y Crédito Popular (the “SOFIPO Law”), originally with the aim of financially including certain sectors of the population that originally did not have access to credit (such as farmers or workers). They combine deposit-taking with lending for retail customers under a tiered system of permitted activities. Higher-level SOFIPOs can issue credit instruments, operate treasury services and expand products by levels (I–IV).

Because SOFIPOs are basically a shadow banking entity, they require comprehensive manuals, governance and technology controls; they also involve affiliation and oversight processes unique to their ecosystem. SOFIPOs are also required to comply with strict AML/CFT obligations in order to obtain their SOFIPO licence. SOFIPOs are required to comply with the AML/CFT Obligations; however, the number of different transactions that SOFIPOs are able to perform means that their AML/CFT manual must be more comprehensive and account for all the activities and services the SOFIPO offers.

Bank for full-service intermediation

Mexican banks are created under the Ley de Instituciones de Crédito (the “Banking Law”) and can perform the widest set of operations under Mexican law, such as taking all kinds of deposits, granting and syndicating credit, issuing bonds and subordinated debt, entering into foreign exchange transactions, entering into derivatives and repo transactions, acting as trustees, distributing payment means, and more.

This alternative is longer and more complex to implement, demanding significant capital, governance and technology, and a formal two-step authorisation (incorporation and operational approval). However, the prize is unmatched breadth and credibility, as Mexico is a primarily banking-focused economy. Mexican banks are also required to comply with the AML/CFT Obligations; however, the amount of different transactions that banks are able to perform means that their AML/CFT manual must be more comprehensive and account for all potential activities and services that the bank offers.

Early-stage choices reflect strategy and readiness

A wallet-focused fintech may prioritise IFPE authorisation to prove its payments model and onboard users rapidly. A digital lender may opt for a SOFOM to launch credit products and iterate on underwriting. A player aiming at deposit-plus-credit in underserved segments may favour a SOFIPO to offer savings, transfers and loans in an integrated way. As these models grow, many ultimately seek to transform into or establish a bank to capture broader services and scale.

Similarities and differences: bank, SOFOM, SOFIPO, IFPE

Although they serve overlapping customer needs, these four vehicles differ in the scope of permitted activities, regulatory burden, capital and governance, and lead times for authorisation. The following comparison highlights core features in plain terms.

Purpose and core activities

Banks provide the full banking service:

• receiving public deposits of all types;
• granting and syndicating loans;
• issuing bank debt;
• operating payments and cards;
• foreign exchange transactions;
• performing trust, trustee and custody services, engaging in derivatives; and
• connecting comprehensively to the central bank’s payment systems.

They are the only entities that combine broad deposit-taking with unrestricted credit intermediation and market operations.

SOFOMs focus on credit. They grant loans, conduct financial factoring and may engage in leasing. A SOFOM ENR is operationally nimble and suited for launching lending products quickly, but it does not take deposits from the public.

SOFIPOs combine deposits and credit for retail clients with a graduated ladder of permitted services by level. As they progress through levels, SOFIPOs may offer payroll services, facilitate leases, issue credit instruments and cards, guarantee third-party obligations and perform treasury functions, subject to prudential rules and oversight specific to their framework.

IFPEs issue and manage electronic funds through wallets and can perform payments, transfers and related services through digital channels. They are specialised for payments and non-cash value in accounts, and may request further approvals for cross-border and foreign currency operations, or for critical outsourcing arrangements.

Regulatory burden, capital and governance

Banks face the most comprehensive oversight. They must meet higher minimum capital requirements, maintain robust risk, AML/CFT, credit and operational frameworks, and obtain an initial incorporation authorisation followed by an operational approval once systems and manuals are fully implemented and tested. Boards must include independent directors, and specialised committees oversee audit, risk, credit, remuneration and communication.

SOFIPOs are closely supervised, operate within a federated oversight model, and must submit detailed programmes of operation, technology, risk and AML/CFT, as well as multi-year financial projections. They are subject to dividend restrictions in early years and careful capital adequacy requirements by level.

IFPEs require extensive technology, security and operational controls, including manuals addressing onboarding, authentication, information security, business continuity, AML/CFT and vendor oversight. Additional approvals are needed for foreign currency wallets, cross-border transfers, virtual assets and critical outsourcing. Furthermore, IFPEs cannot pay interest on deposits, and their ability to fund loans is restricted.

SOFOMs have lighter entry requirements than banks, SOFIPOs and IFPEs, especially in the non-regulated form, making them attractive for rapid credit deployment. However, SOFOMs cannot take deposits and are funded by granting loans or by issuing securities. In addition, they still must comply with transparency, consumer protection, AML/CFT and sector rules relevant to their activities.

Speed to market and evolution path

IFPEs and SOFOM ENRs are often fastest for a first launch, aligning with payments and lending business models, respectively.

SOFIPOs require deeper preparation and co-ordinated oversight but enable deposit-plus-credit under a controlled, progressive framework.

Banks take longer due to dual authorisation (Banxico and CNBV) and greater scrutiny, including capital deposits with the treasury to guarantee seriousness, and regulatory inspections of technology and connections to payment systems prior to final operational approval.

These differences shape the route for players like Nubank or Revolut. For example, a global wallet provider may begin as an IFPE to establish payments presence and then consider expanding to credit through a SOFOM or by transforming into a bank. A credit-first fintech might build scale as a SOFOM and migrate to a bank to add deposits and broader services. A player targeting inclusive finance might launch as a SOFIPO to combine savings and loans and later pursue a bank licence to broaden offerings and increase deposit safeguards.

See this table for a breakdown.

Why banks ultimately do more

For serious players with long-term ambitions, banking confers three decisive advantages: breadth, credibility and integration.

Banks can combine the full spectrum of services – such as deposits, payments, credit, investments and trustee activities, securities markets transactions, foreign exchange, repos and derivatives – into seamless products for individuals and businesses. This enables richer propositions:

• salary accounts linked to credit cards and instant loans;
• treasury services for merchants;
• derivative hedges; and
• comprehensive custody and trustee offerings.

Non-bank paths fragment this stack:

• an IFPE excels at payments but must partner or transform to add credit;
• a SOFOM is strong in lending but lacks deposits; and
• a SOFIPO offers deposits and credit with tiered limits and narrower market operations.

Only banks unify the full scope under one roof.

The banking licence signals stronger prudential oversight, higher capital commitments, independent governance and deeper risk controls. For customers, that means confidence in deposit protection, stronger safeguards and institutional durability. For counterparties and regulators, it means a tested operating environment that can shoulder systemic responsibilities, which take relevance as volumes and complexity grow.

Banks connect deeply to Mexico’s financial infrastructure, including payment systems managed by the central bank, and can access or issue a broad range of instruments. Operational approvals require end-to-end technology readiness and vendor governance. While IFPEs and SOFIPOs do connect to relevant systems, banks have the most comprehensive integration and the fewest structural barriers to layering services.

These factors explain a common trajectory: start where product-market fit is clearest (payments via IFPE, lending via SOFOM, savings-plus-credit via SOFIPO), then migrate to a bank to unify services and scale. Transformations from SOFIPO to bank are feasible within Mexico’s legal framework and benefit from continuity of customers, systems and vendor relationships, subject to upgraded controls, capital and governance.

Practical considerations for each alternative

For IFPEs, the relevant issues are operational and technological. IFPEs must prove the robustness of their platform, authentication methods, information security, disaster recovery and vendor oversight. They may seek additional authorisations for foreign currency wallets, cross-border transfers and critical providers. The business plan and financial projections should demonstrate capitalisation and operating viability, while governance and compliance must include certified AML officers and, where applicable, communications and control committees.

For SOFOMs, the focus is on lending discipline and consumer protection. Clear credit policies, transparency in interest and fees, compliant contracts and AML measures are foundational. Funding strategy, such as lines of credit, securitisations or equity, must match growth plans. Where a SOFOM operates within a banking group (ER), governance and prudential requirements increase. For non-regulated SOFOMs, speed and flexibility are advantages, but credibility and access to deposits remain limited.

For SOFIPOs, planning centres on level-appropriate products, capital adequacy, detailed manuals for credit, deposit-taking, control and risk management, and affiliation or auxiliary supervision processes. Technology readiness and data integrity controls are vital, and dividend restrictions in early years shape capital planning. SOFIPOs can scale product scope progressively, enabling a measured growth path before transforming to a bank.

For banks, preparation is comprehensive:

• shareholders’ information and origin-of-funds checks;
• minimum capital and treasury deposits to guarantee seriousness;
• detailed statutes, committees, manuals and controls;
• multi-year financial projections; and
• full technology integration.

The process involves an initial incorporation authorisation and a final operational approval after systems are inspected and live connections to payment systems are verified. The board must include independent directors, and management must meet technical, honourability and experience standards.

Bringing it together: how global players choose

For a wallet-first global fintech, it will be best to launch an IFPE to issue a digital account with instant payments, bill pay and card rails, acquiring millions of users. To extend into credit, it adds a SOFOM (often ENR) or restructure toward a SOFIPO. When it seeks savings accounts, broader lending and institutional partnerships, it pursues a bank licence to unify services and deepen trust.

A credit-first innovator starts as a SOFOM, perfecting underwriting and collections in merchant or consumer niches. As demand grows for deposit accounts and more comprehensive services, it migrates toward a bank structure to stabilise funding via deposits, broaden product scope and access market operations.

An inclusion-focused player begins as a SOFIPO to serve retail customers with savings and loans under strong protections. With scale, it transforms into a bank to increase deposit safeguards, add credit cards, enhance treasury services and integrate with more complex instruments and payment means.

Each route aligns with a phase of growth. The step to banking is the inflection point at which ambitions move from a single product to a full financial relationship.

Conclusion: banks do more and are the best route for serious players

Mexico’s regulatory architecture offers multiple on-ramps for fintech innovation. IFPEs deliver payments at scale; SOFOMs power credit-first growth; and SOFIPOs combine savings and lending under tiered prudence. These regimes are invaluable for market entry and iteration. Yet for serious players, such as those who plan to serve the general public comprehensively, build durable trust with depositors, partner with enterprises and integrate fully with financial infrastructure, the bank licence is the destination.

Being a bank allows an entity to do more things, in more ways, for more customers. It unifies deposits, payments, credit, trustee services and market operations, enabling richer propositions and faster innovation once the foundation is built. It carries higher expectations of capital, governance and controls, but those expectations translate into credibility and resilience. In a market where the winners will be those who can offer a complete financial relationship safely and at scale, the banking route is the best path forward.