.png){kind=small}
Legal Paradox®
Mexico's crowdfunding framework, investor safeguards and authorization evidence, with named IFC matters and their public-record timelines.
An institución de financiamiento colectivo (IFC) is Mexico's regulated crowdfunding institution. The activity described in the law consists of habitually and professionally connecting members of the public through digital platforms to enter into collective financing transactions. The law reserves that activity to legal entities authorized as IFCs by the Comisión Nacional Bancaria y de Valores (CNBV), with the agreement of the Interinstitutional Committee. Whether a particular business model falls within that activity depends on its facts and structure (LRITF, art. 15, in relation to arts. 4, section XVI, and 11).
IFCs form part of the statutory category of financial technology institutions, or ITFs, alongside the electronic payment funds institutions described in the Wallet category. A technology-based financial business should not be treated as an authorized ITF merely because it describes itself as a fintech (LRITF, arts. 4, section XVI, 11 and 15). An IFC connects investors with applicants; a platform that lends its own resources follows a different route, such as the SOFOM structures described in the Lending category.
The law recognizes three modalities of collective financing. The rights, risks and documents depend on the selected modality and the proposed transaction, so the authorization and operating framework should be evaluated against the structure, not the commercial label attached to the platform.
| Modality | What the transaction involves | Citation |
|---|---|---|
| Debt | Loans or credit transactions creating a direct or contingent liability for the applicant. | LRITF, art. 16, section I |
| Equity | Acquisition of instruments representing an interest in a legal entity's share capital. Different from a contractual promise to repay a loan. | LRITF, art. 16, section II |
| Co-ownership or royalties | Interests in assets or participation in revenue, profits or losses, including the contractual structures identified in the law. | LRITF, art. 16, section III |
The principal framework is the Ley para Regular las Instituciones de Tecnología Financiera (LRITF) and the Disposiciones de Carácter General Aplicables a las Instituciones de Tecnología Financiera (CUITF). The points below describe the main requirements; they are not a complete compliance checklist for every business model.
Minimum capital. An IFC carrying out one type of collective financing operation in national currency requires a minimum of 500,000 UDIs; two or more types of operations fall under the 700,000-UDI requirement. The applicable capital provision also depends on the authorized activities; meeting a capital amount does not determine the regulatory route for a proposed business (CUITF, arts. 6, 7 and 8).
Applicant and project limits. The rules distinguish personal lending from business lending, real-estate development, equity and co-ownership or royalty financing: 50,000 UDIs for personal lending and 1,670,000 UDIs for the other specified categories, with a route for prior CNBV authorization of financing up to 6,700,000 UDIs in the cases covered by the rules. Aggregate applicant exposure must also be assessed. These are regulatory limits, not estimates of a project's fundraising capacity (CUITF, arts. 47 and 48).
Investor concentration. Investment limits follow a concentration formula and its exceptions. The analysis depends on the financing category, investor characteristics and the relevant exception; a single percentage should not be treated as a universal investor cap (CUITF, arts. 49 and 50).
Project evaluation. Platforms must publish selection criteria, apply risk methodologies and verify applicant information. The assessment requirements differ by financing category, including credit information, payment capacity, receivables and real-estate projects where applicable (CUITF, arts. 44 and 45).
Investor protection. The framework includes an electronic acknowledgement of investment risks before contracting, information about the proposed investment and documented conditions for experienced-investor treatment. Acknowledging risk does not remove the platform's disclosure obligations (CUITF, arts. 43, 46 and 50, section V; Annexes 8 and 9).
Public information. The disclosure framework covers project terms, performance information for investors and aggregate public statistics, including arrears and charges. The required information depends on the operation and the disclosure stage (CUITF, arts. 89 to 97; Annex 17).
Client resources. The law separates client funds from the IFC's own resources and prescribes their handling. Those resources are not available for the IFC's own purposes (LRITF, art. 46, in relation to art. 18, section VII; CUITF, arts. 52 to 54).
Governance and internal controls. The authorization and operating framework addresses management information, internal-control and risk-management manuals, and designated compliance, risk and information-security responsibilities. Their implementation belongs in the proposed institution's governance design, not just its application narrative (CUITF, arts. 3, sections V and VI, 61, 62, 63, 64 and 66).
Information security. Requirements cover security governance, testing, authentication, incident handling and business continuity. The technology design and third-party arrangements should be reviewed together against those requirements (CUITF, arts. 61 to 64, 66 to 68, 70 to 72 and 76; Annexes 10 to 12).
Regulatory reporting. IFCs submit standardized information through the CNBV's SITI system, with monthly and quarterly reporting obligations and prescribed formats (CUITF, arts. 98, 99 and 103; Annex 18).
Third-party services. Outsourcing does not transfer the IFC's regulatory responsibility to its provider, and the arrangements remain subject to supervision. The secondary rules require prior authorization for specified sensitive-information and foreign processing arrangements, together with contractual, review and provider-register requirements. The treatment depends on what the provider actually does and accesses (LRITF, art. 54; CUITF, arts. 85 to 88).
Authorization to organize and operate as an IFC is granted by the CNBV with the agreement of the Interinstitutional Committee. The statutory framework addresses the Mexican corporate vehicle, constitutional documents, business plan and operational requirements (LRITF, arts. 11, 35, 36, 39 and 40). The application includes information about management and shareholders, a financial feasibility study, operating and control manuals, and the compliance documentation specified in the rules (CUITF, arts. 3 to 5; Annexes 1 to 5).
The historical market benchmark is 878 calendar days across 27 IFC authorizations (777 across 61 for IFPE), measured from the first application filing to publication in the Diario Oficial de la Federación (dataset build 30 September 2026). Afluenta's IFC authorization took 1,785 days, the longest of any ITF in the dataset. These are observations of published authorizations, not a deadline, a forecast or a commitment for a new application. See the methodology and the authorization timeline dossier.
The transition for businesses already operating when the LRITF entered into force allowed an application period and conditional continuation during the authorization process, with prescribed notices and consequences if no application was made or authorization was refused. This historical regime is not an operating permission for a new entrant today (LRITF, Eighth Transitory Article). The September 2019 first-wave applications belong to that context, and their timelines are not directly comparable with later applications.
An IFC's authorization is not a promise that an investment will succeed. The law prohibits an IFC from assuring investment returns or guaranteeing the success of investments, and restricts financing of the IFC's own projects and those of related persons (LRITF, arts. 18, sections I, II, III and VIII, 20 and 21). Client resources are not guaranteed by the government, and the law requires that warning to be displayed (LRITF, art. 11).
Names and representations also matter. The law restricts the use of reserved institutional terms and sanctions their unauthorized use; operating activities reserved to an IFC without authorization can have administrative and criminal consequences. Whether particular conduct falls within a prohibition requires an analysis of the facts (LRITF, arts. 12, 103, section I, 110, 124, section I, and 129). IFCs are also subject to anti-money-laundering and counter-terrorist-financing obligations, including customer identification, risk controls and reporting (LRITF, art. 58).
An authorization record establishes regulatory dates; it does not describe every service provided by counsel. The roles below are distinct, and each authorization links to its publication in the DOF on the named matters page.
| Client | Role of Legal Paradox® | Public record |
|---|---|---|
| Inverteca (Grupo Quindalo) | Prepared the file and carried it through to authorization. | 418 days · DOF 10 April 2023. A single, dated result, not a firm average. |
| Prestadero | Prepared the file and carried it through to authorization. | 642 days · DOF 23 June 2021. First wave (September 2019). Filed the same day as Yo Te Presto; publications 322 days apart, which does not establish the cause. |
| Red Girasol | Prepared the file and carried it through to authorization. | 959 days · DOF 11 May 2022. First wave (September 2019). |
| Fundary | Continuous regulatory counsel. | Authorization not attributed to Legal Paradox®. |
| ArkAngeles | Continuous regulatory counsel. | Authorization not attributed to Legal Paradox®. |
The Legal Paradox® Fintech Map provides a continuously updated directory of crowdfunding platforms operating in Mexico, with their regulatory status and the timelines of the authorizations published in the DOF. Below you will find the crowdfunding companies in the Mexican fintech ecosystem.
Legal Paradox® is a Chambers-ranked law firm (Band 4, FinTech Mexico) whose core practice is fintech and financial regulation. The firm took part in the 270+ working meetings that produced the Ley Fintech and co-drafted its secondary regulation through the British Embassy Prosperity Fund. Legal Paradox® has advised on 520+ fintech projects, including 8 unicorns, 9 banks, and 4 BigTech companies.
For teams evaluating a crowdfunding model in Mexico — choice of modality, capital and financing limits, investor protection architecture, the authorization file, or responses to CNBV observations — discuss your structure and regulatory questions with Carlos Valderrama in a 45-minute call. The regulatory path depends on the facts of the proposed operation.
Data sourced from the Legal Paradox® Fintech Map and Regulatory Intelligence Dashboard. Regulatory references from the LRITF (reform of 14 November 2025), the CNBV Disposiciones de Carácter General Aplicables a las ITFs (CUITF), and DOF publications. Last updated September 2026.
