What is an ITF and how does it differ from a bank?

A Financial Technology Institution (ITF) is an entity authorized to provide financial services through technological platforms. Unlike banks, ITFs maintain fully digital operations and typically do not have physical branches.

Are funds in an IFPE guaranteed by the government?

No. The Law expressly states that neither the Federal Government nor any parastatal public administration entities may be held responsible for or guarantee the client funds used in operations with Financial Technology Institutions (ITFs).

How long does it take to obtain an ITF authorization?

The process can take between 1 and 5 years, depending on the complexity of the business model, the quality of the documentation submitted, and the number of official requests for information issued by the authority. Legal Paradox maintains the best average market times: 416 days for IFPE (Electronic Payment Fund Institutions) and 418 days for IFC (Crowdfunding Institutions), compared to market averages of 781 and 878 days respectively, based on DOF data.

Can ITFs operate with cryptocurrencies?

Not directly. ITFs may only operate with virtual assets for Internal Operations, subject to prior authorization from Banxico (the Central Bank of Mexico). They cannot directly offer exchange, custody, or transmission services of virtual assets to clients. Companies seeking to provide virtual asset services may register as a VASP (Virtual Asset Service Provider) under anti-money laundering regulations.

What is the Regulatory Sandbox and who can participate?

The Regulatory Sandbox (Innovative Model) allows testing innovative financial services with temporary regulatory exemptions. Mexican legal entities that are not financial institutions may participate, as well as existing financial entities for new models. Authorization is temporary (maximum 3 years) and discretionary. Legal Paradox developed a strategy based on an innovative model to obtain an administrative act from the CNBV that enabled the first legal tokenization in Mexico (the Etherfuse case).

What happens if a company operates as an ITF without authorization?

The CNBV can order the immediate suspension of operations, close the business, and impose fines ranging from 5,000 to 150,000 UMA (approximately $542,000 to $16.3 million MXN). Furthermore, criminal proceedings may be initiated for illegal public solicitation of funds, which carries a prison sentence of 7 to 15 years.

What is the minimum capital required to operate an ITF?

The minimum capital varies depending on the type of ITF and its activities: for both IFC and IFPE, it ranges from 500,000 UDIs to 700,000 UDIs (approximately $4.4 to $6.1 million MXN). However, in practice, depending on the financial feasibility analysis, the regulator may request up to $10 million MXN.

How can I verify if an ITF is authorized?

You can check the CNBV Portal of Supervised Entities (www.cnbv.gob.mx) or the Legal Paradox Fintech Map (fintechmap.legalparadox.com/map), which tracks 800+ fintech companies in Mexico with real-time regulatory status data.

What are the principles of the FinTech Law?

The FinTech Law is built on 7 principles: (1) Financial inclusion and innovation, (2) Promotion of competition, (3) Consumer protection, (4) Financial stability, (5) Prevention of illegal operations through AML/CFT controls, (6) Technological neutrality ensuring the law applies regardless of the specific technology used, and (7) Regulatory proportionality.

How does the FinTech Law impact financial inclusion?

The Law has a significant impact on financial inclusion by providing a regulatory framework that encourages the development of innovative financial services, increasing access to financial products in a country where a large segment of the population remains underbanked. Since the publication of the Law, Mexico's fintech sector has grown by more than 596%, positioning Mexico as the second-largest fintech market in Latin America.

Mexico Fintech Law 2026: Guide by the Lawyers Who Drafted It

Key Articles of the FinTech Law

Below are the most relevant articles of the Law to Regulate Financial Technology Institutions. For the full text, consult the Legal Library at the bottom of this page.

Article 1. This Law is of public order and general observance in the United Mexican States. Its objective is to regulate the financial services provided by financial technology institutions, as well as their organization, operation, and functioning, and the financial services subject to specific regulations that are offered or carried out through innovative means.

Article 2. This Law is based on the principles of financial inclusion and innovation, promotion of competition, consumer protection, preservation of financial stability, prevention of illegal operations, and technological neutrality. These principles must be respected by all subjects bound by this Law regarding their operations, as well as by Financial Authorities in the exercise of their powers.

Article 3. Supervision of compliance with the provisions of this Law and the regulations emanating from it shall correspond to the National Banking and Securities Commission (CNBV) and the Bank of Mexico (Banxico), within the scope of their respective competencies, in terms of this Law and other applicable legal provisions.

The National Insurance and Bonding Commission (CNSF), the National Commission for the Retirement Savings System (CONSAR), and the National Commission for the Protection and Defense of Financial Services Users (CONDUSEF) shall have the powers conferred upon them by this Law and other applicable legal provisions within their respective competencies.

The Federal Executive, through the Ministry of Finance and Public Credit (SHCP), may interpret the provisions of this Law for administrative purposes.

Article 4. For the purposes of this Law, in singular or plural, the following shall be understood as:

I. Financial Authority: Any of the Supervisory Commissions, the Bank of Mexico, or the Ministry (SHCP), according to their scopes of competence.

II. Client: The natural or legal person who contracts or carries out any Operation with an ITF, as well as the person who contracts or uses the services of Financial Entities provided for in this Law or of companies authorized to operate with Innovative Models.

III. CNBV: National Banking and Securities Commission.

IV. CNSF: National Insurance and Bonding Commission.

V. Supervisory Commissions: The CNBV, CONSAR, CNSF, and CONDUSEF, regarding their scopes of competence.

VI. Inter-institutional Committee: The collegiate body integrated by public servants from the SHCP, the Bank of Mexico, and the CNBV as referred to in this Law.

VII. CONDUSEF: National Commission for the Protection and Defense of Financial Services Users.

VIII. CONSAR: National Commission for the Retirement Savings System.

IX. Consortium: A group of legal entities linked to each other by one or more natural persons who, integrating a Group of Persons, have Control over the former.

X. Control: The capacity to impose, directly or indirectly, decisions at general shareholders' meetings, partner meetings, or equivalent bodies; to appoint or remove the majority of directors, administrators, or their equivalents of a legal entity; to hold the rights that allow, directly or indirectly, the exercise of votes regarding more than fifty percent of the social capital; or to direct, directly or indirectly, the administration, strategy, or main policies of the company, whether through ownership of Securities or by any other legal act.

XI. Relevant Executive: The Chief Executive Officer (Director General) of the ITFs, as well as natural persons who, holding an employment, position, or commission in them or in the legal entities that have Control over said ITFs or are controlled by them, adopt decisions that significantly impact the administrative, financial, operational, or legal situation of the ITF or the Business Group to which it belongs. ITF directors (consejeros) are not included in this definition.

XII. Financial Entities: Holding and sub-holding companies of financial groups, credit institutions (banks), brokerage houses, stock exchanges, investment fund management companies, investment fund share distribution companies, credit unions, auxiliary credit organizations, foreign exchange houses (casas de cambio), multiple-purpose financial companies (SOFOM), popular financial companies (SOFIPO), community financial companies (levels I to IV), rural financial integration organisms, savings and loan cooperative societies (levels I to IV), securities deposit institutions, central securities counterparties, securities rating agencies, credit information companies (credit bureaus), insurance institutions, bonding institutions, mutual insurance societies, retirement fund administrators (AFORE), as well as other institutions and public trusts that perform activities over which the CNBV, CNSF, or CONSAR exercise supervisory powers.

XIII. Group of Persons: Persons who have agreements, of any nature, to make decisions in the same direction. Unless proven otherwise, a Group of Persons is presumed to be:

a) Persons related by blood, affinity, or civil relationship up to the fourth degree, spouses, and domestic partners (concubina/concubinario).

b) Companies that are part of the same Consortium or Business Group and the person or set of persons who have Control over said companies.

XIV. Business Group: A set of legal entities organized under schemes of direct or indirect social capital participation, in which a single company maintains Control over said legal entities, including financial groups constituted according to the Law to Regulate Financial Groups.

XV. Technological Infrastructure: The computing infrastructure, telecommunications networks, operating systems, databases, software, and applications used by ITFs, companies authorized to operate with Innovative Models, and financial entities to support their operations.

XVI. ITF: Financial Technology Institutions regulated by this Law, which are Crowdfunding Institutions (IFC) and Electronic Payment Fund Institutions (IFPE).

XVII. Innovative Model: That which, for the provision of financial services, uses technological tools or means with modalities different from those existing in the market at the time the temporary authorization is granted in terms of this Law.

XVIII. Operations: Financial or payment acts referred to in this Law that an ITF may offer or perform with the public or that are performed between Clients through them, in terms of this Law.

XIX. Related Persons: Persons who, regarding an ITF, fall into any of the following categories:

a) Natural or legal persons who maintain, directly or indirectly, ownership of one percent or more of the capital stock of an ITF.

b) The sole administrator or members of the board of directors of the ITF, as well as auditors, statutory auditors (comisarios), officers, or employees who can legally bind the ITF with their signature.

c) Spouses and relatives up to the second degree of the persons mentioned above.

d) Legal entities in which the ITF maintains, directly or indirectly, ownership of ten percent or more of the capital stock.

e) Legal entities in which any of the persons mentioned above, as well as officers, employees, and auditors, maintain ownership of ten percent or more of the capital stock.

f) Legal entities where officers or auditors of the ITF serve as directors or occupy any of the first three hierarchical levels.

XX. Command Power: The factual capacity to decisively influence agreements adopted at shareholders' meetings or board sessions, or in the management and execution of the business of the ITF or the legal entities it controls. Unless proven otherwise, Command Power is presumed for:

a) Shareholders who have Control.

b) Natural persons with links to the ITF through life-long, honorary, or similar titles.

c) Persons who have transferred Control of the ITF for free or below market value to relatives up to the fourth degree or spouses.

d) Persons who instruct directors or Relevant Executives of the ITF on decision-making or operation execution.

XXI. Secretariat (Secretaría): Ministry of Finance and Public Credit (SHCP).

XXII. UMA: Unit of Measure and Update, whose equivalent value in pesos is determined according to the Law to Determine the Value of the Unit of Measure and Update.

XXIII. Securities (Valores): Shares, social parts, obligations, bonds, warrants, certificates, promissory notes, bills of exchange, and other credit instruments, named or unnamed, issued in series or mass, representing capital stock or a part of a good, or participation in collective credit, in terms of applicable national or foreign laws.

Article 15. Activities aimed at connecting members of the general public so they can grant financing to each other through the Operations specified in the following article—when performed habitually and professionally via software applications, interfaces, websites, or any other means of electronic or digital communication—may only be carried out by legal entities authorized by the CNBV, following the agreement of the Inter-institutional Committee, as Crowdfunding Institutions (IFC).

Article 16. Clients of a crowdfunding institution participating in the activities provided for in the preceding article shall be referred to as investors and applicants. Investors are natural or legal persons who provide resources to applicants. Applicants are natural or legal persons who have requested such resources through the crowdfunding institution.

Clients of a crowdfunding institution may carry out the following Operations among themselves through said institution:

I. Debt Crowdfunding: For investors to grant loans, credits, or any other financing that causes a direct or contingent liability for the applicants.

II. Equity Crowdfunding: For investors to buy or acquire securities representing the capital stock of legal entities acting as applicants.

III. Joint Venture or Royalty Crowdfunding: For investors and applicants to enter into joint ventures (asociaciones en participación) or any other type of agreement whereby the investor acquires a shared portion or participation in a present or future asset, or in the income, profits, royalties, or losses obtained from the activities or projects of an applicant.

Legal acts performed for these Operations shall be considered acts of commerce.

Operations shall be denominated in national currency. However, crowdfunding institutions may perform these Operations in foreign currency or with virtual assets in cases and subject to terms and conditions established by the Bank of Mexico (Banxico) through general provisions.

Securities offered through these institutions may not be registered in the National Securities Registry (Registro Nacional de Valores).

Crowdfunding institutions may facilitate the sale or acquisition of the rights or securities exchanged that document the Operations. The CNBV shall establish general provisions for this purpose to protect investors.

Article 17. Crowdfunding institutions may act as agents (mandatarias) or commission agents (comisionistas) for their Clients to perform activities related to the Operations, including operational matters, under terms determined by the CNBV.

Article 18. Crowdfunding institutions must comply with the following obligations:

I. Clearly disclose selection criteria for applicants and projects, the information analyzed, and verification activities performed. They are prohibited from offering projects currently being offered on another crowdfunding platform at the same time.

II. Analyze and inform potential investors in a simple and clear manner about the risks of applicants and projects, including payment behavior indicators.

III. Obtain an electronic certificate from investors stating they are aware of the risks to which their investment is subject.

IV. Provide investors with information on the applicant’s payment behavior and performance once an Operation has been completed.

V. Provide Clients with the necessary means to formalize Operations.

VI. Use at least one credit information bureau (Credit Bureau) to periodically provide applicant information (applicable only to Debt Crowdfunding).

VII. Deliver investor resources to the selected applicants and allow investors to withdraw their funds without restriction or charge prior to delivery.

VIII. Establish risk-sharing schemes for debt crowdfunding to align incentives between the ITF and investors (e.g., performance-based commissions). Commissions for delinquent loans may never be higher than those for current loans.

IX. Maintain mechanisms to segregate each type of Operation so investors can clearly distinguish between them.

X. Comply with all other obligations established in this Law.

Crowdfunding institutions shall be liable for damages caused to their Clients due to non-compliance with this article.

Article 19. Crowdfunding institutions may only perform the following additional activities:

I. Receive and publish crowdfunding requests.

II. Facilitate potential investors' knowledge of the requests and projects.

III. Enable electronic communication channels between investors and applicants.

IV. Obtain loans and credits from any person to fulfill their corporate purpose (subject to CNBV authorization for risk-sharing schemes). Such loans cannot be obtained from the general public or through mass media.

V. Issue Securities on their own behalf (proceeds from public offerings of debt securities cannot be used for project risk-sharing schemes).

VI. Acquire or lease movable or immovable property necessary for their purpose.

VII. Make deposits in authorized financial entities.

VIII. Constitute necessary trusts (fideicomisos).

IX. Make permanent investments in other companies providing auxiliary or real estate services.

X. Perform judicial or extrajudicial collection of credits on behalf of investors and renegotiate credit terms.

XI. Perform acts necessary for their corporate purpose.

Article 20. Crowdfunding institutions are prohibited from guaranteeing returns or yields on investments or guaranteeing the success of investments.

Article 21. The following cannot be applicants for financing:

I. The ITF itself.

II. Related Persons or persons with Command Power in the ITF.

ITFs may only participate as investors when using authorized risk-sharing schemes.

Banks, brokerage houses, and other regulated financial entities may act as investors through crowdfunding institutions, subject to rules established by the CNBV.

Crowdfunding institutions must refrain from selling or assigning credits or loans celebrated between Clients to Related Persons or those with Command Power. Likewise, Financial Entities may not sell or assign credits through ITFs that were previously granted by said Entities to their own clients.

Article 22. Services performed with the public on a habitual and professional basis, consisting of the issuance, administration, redemption, and transmission of electronic payment funds—through the acts identified below and via software applications, interfaces, websites, or any other electronic or digital communication means—may only be provided by legal entities authorized by the CNBV, following the agreement of the Inter-institutional Committee, as Electronic Payment Fund Institutions (IFPE):

I. Opening and maintaining one or more electronic payment fund accounts for each Client, recording credits equivalent to the amount of electronic payment funds issued against the receipt of a sum of money (national or foreign currency) or specific virtual assets;

II. Carrying out transfers of electronic payment funds between its Clients through the respective credits and debits in the accounts referred to in section I;

III. Carrying out transfers of specific amounts of money in national currency or, subject to prior authorization from the Bank of Mexico, in foreign currency or virtual assets, between its Clients and those of another IFPE, as well as account holders or users of other Financial Entities or foreign entities empowered to perform similar operations;

IV. Delivering an amount of money or virtual assets equivalent to the amount of electronic payment funds in an account, through the respective debit to said account; and

V. Maintaining the updated record of accounts, reflecting the entry, transfer, and withdrawal of electronic payment funds.

Article 23. For the purposes of this Law, electronic payment funds are considered to be those funds recorded in an electronic transactional account registry maintained by an IFPE that:

I. Refer to a monetary value equivalent to a specific amount of money (national currency or, with Banxico's authorization, foreign currency) or a specific number of units of a virtual asset determined by the Bank of Mexico;

II. Represent a payment obligation of the issuer for the same amount of money or units of virtual assets;

III. Are issued upon receipt of the money or virtual assets for the purpose of crediting, transferring, or withdrawing said funds, in whole or in part, per the holder's instructions; and

IV. Are accepted by a third party as receipt of the respective amount of money or virtual assets.

Article 24. The following shall not be considered electronic payment funds:

I. Loyalty or Reward Programs: Rights that can only be accepted by the issuer or affiliates for goods/services and cannot be converted to legal tender.

II. Pre-payments for goods/services: Amounts accepted only by the issuer or its Business Group for specific goods/services, provided they cannot be converted to legal tender.

III. Irregular money deposits: Deposits received by Financial Entities under laws that expressly authorize such operations.

IV. Money transmissions: Resources handled by Financial Entities or money transmitters regulated by the General Law of Auxiliary Credit Organizations and Activities.

Article 25. IFPEs may only perform the following operations and activities:

I. Issue, market, or manage instruments for the disposal of electronic payment funds (e.g., debit cards or digital tokens);

II. Provide money transmission services;

III. Provide services related to payment networks (acquirer, aggregator, etc.);

IV. Process information related to payment services;

V. Grant credits or loans in the form of overdrafts: Solely derived from the transmission of electronic payment funds and subject to specific conditions;

VI. Perform operations with virtual assets, per this Law;

VII. Obtain loans for their corporate purpose (but not for issuing funds or granting credit);

VIII. Issue Securities on their own behalf;

IX. Constitute deposits in authorized financial entities;

X. Acquire or lease necessary assets;

XI. Connect third parties to facilitate the purchase/sale of virtual assets;

XII. Buy/sell virtual assets for their own account or for Clients; and

XIII. Perform acts necessary to achieve their corporate purpose.

Article 26. The characteristics of IFPE operations and payment system activities shall be subject to general provisions issued by the Bank of Mexico. Operations in foreign currency or virtual assets require prior authorization from Banxico.

Article 27. IFPEs may only grant overdrafts under these conditions:

I. Not funded by client resources or virtual assets;

II. No interest, accessories, or commissions may be charged;

III. The balance must be collected immediately upon the receipt of any new funds or assets from the debtor Client;

IV. The amount must not exceed the limit determined by the Bank of Mexico.

Article 28. Funds in accounts with no activity (deposits, redemptions, transfers, or balance inquiries) for three years must be moved to a global account. The IFPE must notify the Client 90 days in advance.

If the amount is ≤ 300 UMA, rights expire in favor of public charity after 3 years in the global account.

If the amount is > 300 UMA, rights expire in favor of public charity after 7 years in the global account.

Article 29. IFPEs cannot pay interest or any other monetary yield for the balance maintained by Clients. However, Banxico may allow non-monetary benefits.
Resources received for electronic payment funds are not bank deposits. The IFPE must be able to reimburse the Client in national currency (or virtual assets, if applicable) upon request. Clients must designate beneficiaries in case of death.

Article 39. Applications to obtain authorization from the CNBV as provided in this Chapter must be accompanied by the following:

I. Legal Representation: The instrument duly notarized before a public official granting sufficient powers to the representatives of the applicants.

II. Corporate Bylaws: The draft of the social statutes (bylaws), or amendments thereto, complying with the requirements of this Law.

III. Business Plan: A comprehensive plan detailing the operational strategy.

IV. Account Separation Policies: Policies regarding the segregation of funds, as established in Article 46.

V. Risk Disclosure Policies: Policies for disclosing risks and responsibilities for Operations in the ITF. This must use clear and simple language and include the total amount of commissions, charges, or withholdings, as well as warnings on the digital interface or website.

VI. Operational Risk and Information Security: Measures and policies regarding operational risk control and information security, including confidentiality policies and evidence of a secure, reliable, and precise technological support system that ensures confidentiality, availability, and integrity to prevent fraud and cyberattacks.

VII. Customer Identification (KYC): Operational processes and controls for identifying Clients, establishing precise and consistent criteria for evaluation and selection.

VIII. Conflict of Interest: Policies for resolving potential conflicts of interest in the performance of activities.

IX. AML/CFT Policies: Policies for the prevention of fraud, money laundering, and the financing of terrorism.

X. Critical Third-Party Contracts: A list of agreements or contracts with other ITFs or technology providers necessary for key business processes, database management, and Technological Infrastructure.

XI. Shareholder Information: A list and information regarding persons who directly or indirectly hold or intend to hold a stake in the social capital. This must include the amount to be subscribed, the proven source of funds, and financial status (last 3 years of financial statements or asset declarations), demonstrating honorability and a satisfactory credit and business history.

XII. Management Information: Information regarding the administrator or board members (or candidates) to verify their honorability and satisfactory credit and business history.

XIII. Ownership of Digital Channels: Information necessary to verify that the ITF or its Business Group owns or has the right to use the interface, website, or digital communication medium.

XIV. Legal Domicile: Designation of a domicile within national territory for receiving notifications and at least one representative.

XV. Incentive Alignment (Crowdfunding only): Information regarding the scheme to be adopted for the alignment of incentives, applicable to Crowdfunding Institutions (IFC).

XVI. Additional Documentation: Any other documentation required by the general provisions issued by the CNBV.

Existing companies seeking authorization must provide the applicable documentation and a draft of the governing body's resolution regarding the necessary amendments to their bylaws.

The CNBV must make all documentation received available to the members of the Inter-institutional Committee.

Article 76. Financial Entities, money transmitters, credit information societies, clearing houses referred to in the Law for Transparency and Regulation of Financial Services, ITFs, and companies authorized to operate with Innovative Models shall be obliged to establish standardized computer application programming interfaces (APIs) that enable connectivity and access for other interfaces developed or managed by the same subjects referred to in this article and third parties specialized in information technologies, for the purpose of sharing the following data and information:

I. Open financial data: those generated by the entities mentioned in the first paragraph of this article that do not contain confidential information, such as information on products and services offered to the general public, the location of their offices and branches, automated teller machines (ATMs), or other access points to their products and services, among others and as applicable;

II. Aggregated data: those relating to any type of statistical information related to operations carried out by or through the entities mentioned in the first paragraph of this article, without containing a level of disaggregation such that personal data or transactions of a person can be identified. Only persons who have the authentication mechanisms established by the Supervisory Commissions, or the Bank of Mexico in the case of clearing houses and credit information societies, through general provisions issued for such purpose, shall have access to aggregated data; and

III. Transactional data: those related to the use of a product or service, including deposit accounts, credits, and means of disposal contracted in the name of the clients of the entities mentioned in the first paragraph of this article, among other information related to transactions that clients have performed or attempted to perform in their Technological Infrastructure. This data, in its nature as personal data of the clients, may only be shared with their prior express authorization.

The information mentioned in the preceding paragraph may only be used for the purposes strictly authorized by the client. The entities mentioned in the first paragraph of this article must interrupt access to information as soon as the holder withdraws their consent, vulnerabilities exist that put their clients' information at risk, or the third party fails to comply with the terms and conditions agreed upon for the exchange of information. Such interruption must be notified within a period no longer than two hours from its detection to the Supervisory Commissions or the Bank of Mexico, as applicable, and said authorities, within their scope of competence, may order the restoration of access to information in cases where it is determined that the interruption was unjustified, regardless of the corresponding administrative sanctions.

The exchange of data and information that may be shared in terms of this article shall be subject to general provisions issued by the Supervisory Commission, or the Bank of Mexico in the case of credit information societies and clearing houses, in which the necessary standards for the interoperability of application programming interfaces may be established; the design, development, maintenance, and security mechanisms of these interfaces for accessing, sending, or obtaining data and information; the information considered critical for the proper functioning of applications that require the use of these interfaces; as well as the mechanisms through which client consent will be obtained.

For access to information through standardized computer application programming interfaces by the persons mentioned in this article, prior authorization from the Supervisory Commissions or the Bank of Mexico shall be required for credit information societies and clearing houses. The authorizations granted under this article will allow the recipient to access the available interfaces of the type of entity for which access is requested.

The Supervisory Commission or, as the case may be, the Bank of Mexico, must authorize the considerations (fees) charged by the entities mentioned in the first paragraph of this article for the exchange of data and information, which must be equitable and transparent to all individuals involved so that in no case do they constitute formal, regulatory, economic, or practical barriers to entry.

For the purposes of the preceding paragraph, the referred entities must register the aforementioned considerations, as well as their respective modifications, with the Supervisory Commissions or the Bank of Mexico. Such registration shall be made at least thirty calendar days prior to their effective date for new considerations or when they involve an increase.

In the case of a reduction in the amount of such considerations, the registration must be made at least two calendar days prior to its effective date.

The above must be carried out in the form and terms specified by the Supervisory Commissions or the Bank of Mexico in general provisions.

The Supervisory Commissions or the Bank of Mexico shall have the power to formulate observations on the application of such considerations when they are new or involve an increase, within the fifteen business days following the date on which the aforementioned entities bring them to their knowledge. Before exercising said power, the competent Financial Authority shall hear the entity in question. The Supervisory Commissions or the Bank of Mexico will make public the observations they formulate under this paragraph. In the event that the competent Financial Authority has formulated and published observations regarding the creation or increase of considerations, and the entities decide to apply the new considerations or the observed increase, said Financial Authority may veto it, in which case they may not charge such consideration without being exempt from complying with the obligation referred to in this article. If there are no observations, the considerations shall enter into force.

In no case may the entities referred to in this article charge differentiated considerations for access to their information.

The entities mentioned in the first paragraph of this article, under their responsibility, may allow information and data applicants to propose and test the introduction of new products and services before being offered to the public, temporarily exchanging such information and data with them during the testing stage, provided they comply with the requirements and conditions established for such purpose by the Supervisory Commission or the Bank of Mexico.

The Supervisory Commission or the Bank of Mexico, after granting the right to a hearing to the entities mentioned in the first paragraph of this article, may order the partial or total, temporary or definitive suspension of the exchange of information and data being carried out when the general provisions referred to in this article are breached in protection of the public interest. This applies unless the Supervisory Commission, or the Bank of Mexico, approves a regularization program that meets the requirements established in said general provisions.

The Supervisory Commission or the Bank of Mexico may require from the entities and, through them, from those with whom they exchange data and information, records, documents, data, reports, and in general, the information it deems necessary to verify compliance with this article and the provisions emanating from it.

The Supervisory Commission or the Bank of Mexico will directly formulate information requirements and, if applicable, observations and corrective measures resulting from the supervision carried out under this article to ensure information integrity and adherence to this Law. Furthermore, the Supervisory Commission or the Bank of Mexico shall be empowered at all times to perform acts of supervision, inspection, and surveillance regarding the third parties with whom the entities exchange data and information, as well as to practice inspections on said third parties or order the entities to perform audits on them, with the entity being obliged to render a report to the corresponding authority.

The Supervisory Commission or the Bank of Mexico must specify the object of the inspections or audits, which must be limited to the subject matter of the contracted service and compliance with this Law and its provisions. To this end, entities must agree in the contracts formalizing the exchange of data and information on the express stipulation that the contracted third party accepts to abide by the provisions of this article.

Article 80. Legal entities constituted in accordance with Mexican commercial legislation, other than ITFs, Financial Entities, and other subjects supervised by a Supervisory Commission or the Bank of Mexico, must obtain authorization to carry out, through Innovative Models, any activity that requires an authorization, registration, or concession in accordance with this Law or any other financial law.

For the operation of Innovative Models, the Financial Authorities, within their scope of competence and at their discretion—following a review of compliance with the criteria and conditions established in Article 82 of this Law—may grant or deny, with due legal basis and motivation, a temporary conditional authorization to companies interested in providing financial services through these Models. Said authorization shall have a duration consistent with the services intended to be provided and may not exceed two years.

In the case of Supervisory Commissions, the prior agreement of the respective Governing Board shall be required for the granting of the authorizations referred to in this article.

If the activities require authorization, registration, or concession by the Ministry (SHCP) or the Bank of Mexico, temporary authorizations shall be issued considering the administrative acts provided for in the laws regulating such activities. If it corresponds to the Ministry to grant the mentioned authorizations, the Supervisory Commissions shall be competent to supervise the activities of the companies authorized to operate with Innovative Models that perform the same activities reserved for Financial Entities or subjects supervised by said Commissions.

The corresponding company must take the necessary actions to obtain the definitive authorization, registration, or concession during the term of the temporary authorization, according to the financial laws regulating such acts. If it does not perform said actions, it must carry out the exit procedure referred to in section X of Article 83 of this Law. If the authorized company is taking the necessary actions to obtain the definitive authorization, registration, or concession, the competent Financial Authority, at its discretion, may extend the temporary authorization for up to one additional year, during which all actions necessary to obtain the definitive authorization and start operations must be completed.

In the authorization granted under this article, the Financial Authorities shall establish, based on the corresponding Innovative Model, the exceptions and conditions for compliance with the requirements and obligations established in the respective financial laws, as well as the terms and conditions for the provision of the services in question. In the case of extensions, such exceptions, conditions, terms, and conditions may be reviewed to ensure the continued viability of the company authorized to operate with Innovative Models.

Article 81. In the event that two or more Supervisory Commissions have the power to hear the matters referred to in this Chapter, or if the activities in question are also subject to the authorization of the Bank of Mexico or the Ministry, the authorization requests must be submitted to the Financial Authority whose powers are related to the predominant activity that the company intends to carry out under the Innovative Model. Said Authority shall be obliged to forward the respective file to the other competent Financial Authorities to resolve it jointly.

Article 82. To grant the temporary authorization referred to in Article 80 of this Law, the Financial Authorities shall evaluate, among other aspects, compliance with the following criteria and conditions:

I. The proposal must be an Innovative Model;

II. The product to be offered or the service to be provided to the public must require testing in a controlled environment, in terms of this Chapter;

III. The manner in which the reserved activity is intended to be developed must represent a benefit to the Client of the product or service compared to what exists in the market;

IV. The project must be at a stage where the start of operations can be immediate;

V. The project must be able to be tested with a limited number of Clients; and

VI. Any others determined by the competent Financial Authorities through general provisions.

Article 83. In the application for temporary authorization, companies intending to operate with Innovative Models must include the following:

I. Draft of the social statutes (bylaws), which must include:

a) The habitual or professional performance, within its corporate purpose, of the activities it intends to carry out; and

b) The establishment of its legal domicile within national territory;

II. A description of the Innovative Model, the total operations or activities intended to be performed through it, and the details of each, justifying the need to operate under said Model;

III. Risk analysis policies, including security policies for Technological Infrastructure and information security;

IV. The legal provisions regulating the reserved activity that are considered to hinder the development of the products or services through the Innovative Model;

V. Potential benefits for the Clients of the service or product compared to what exists in the market;

VI. The target market or maximum number of Clients to whom the product or service would be offered, specifying, if applicable, the geographic location and the maximum amount of resources that may be received from each Client, as well as the total maximum amount that may be received during the term of the temporary authorization;

VII. The manner in which they will compensate for damages that may be caused to Clients by the provision of services during the development period, which must be agreed upon in the contracts celebrated for such purpose;

VIII. The manner in which they intend to inform and obtain the consent of their Clients regarding the fact that they will be entering into operations with companies authorized to operate with Innovative Models, as well as the risks to which they are subject as a result;

IX. The form, method, and timeframes in which they will comply with the requirements to obtain the definitive authorization, registration, or concession according to the financial laws regulating the service;

X. The exit procedure to be carried out in case the Financial Authorities do not grant the definitive authorization, registration, or concession, or the term of the temporary authorization or its extension ends; and

XI. Any other documentation and information required by the competent Financial Authorities.

The submission of the authorization request must be approved by the administrative body of the company.

Each Financial Authority must publish the temporary authorizations it grants in a public registry, providing dissemination on its website. This registry shall contain notes for each authorized company, which may include the revocation of the authorization.

Article 84. CONDUSEF, in terms of the Law for the Protection and Defense of Financial Services Users, shall have the powers granted by said Law to resolve disputes between companies authorized to operate an Innovative Model and their Clients.

Article 85. Companies authorized to operate with Innovative Models shall be subject to Titles I and VII and Chapter IV of Title III of this Law, as well as Articles 48, third paragraph, and 58. The powers granted to the CNBV in these provisions shall be understood as granted to the other Financial Authorities within their respective competencies.

Article 86. Financial Authorities may, at their discretion and with due legal basis and motivation, authorize Financial Entities, ITFs, or other persons subject to their supervision to temporarily carry out operations or activities of their corporate purpose through Innovative Models when their execution requires exceptions or conditions to the applicable general provisions issued by the Authorities themselves.

Temporary authorizations under this article must be granted following the agreement of the Governing Board of the respective Supervisory Commissions. For activities regulated by general provisions issued by the Ministry or the Bank of Mexico, temporary authorizations shall be granted by said Authorities.

The Financial Authority shall establish the exceptions, conditions, terms, and conditions for the products or services. These authorizations may not exceed one year, renewable once for an additional year.

Article 87. To obtain the authorization referred to in this Chapter, interested parties must submit an application accompanied by:

I. A description of the Innovative Model and all operations, justifying the need for the temporary authorization;

II. Risk analysis, Technological Infrastructure, and information security policies;

III. The legal provisions considered to hinder the development of the services;

IV. Potential benefits for Clients compared to the market;

V. The target market, maximum number of Clients, geographic location, and resource limits;

VI. Information proving that the operation does not jeopardize the stability or solvency of the Financial Entity or the person's operability;

VII. The manner of compensating for damages, to be included in client contracts;

VIII. The means to inform Clients of the risks;

IX. Actions to be taken once the temporary authorization expires; and

X. Any other documentation required by the competent Financial Authorities.

The submission of the authorization request must be approved by the board of directors of the Financial Entity or person subject to supervision.

Mexico FinTech Law 2026. The Definitive Guide to FinTech Regulation.

Why trust this guide?

What has been the impact of the FinTech Law?

The Origin of the Fintech Law: From the Gray Area to the Major Leagues

2008 - 2016: The Problem.

2016-2018: The Solution.

What is the FinTech Law?

Who does it apply to?

Financial Technology Institutions

Crowdfunding Institutions (IFC)

Types of Operations

Minimum Capital

Authorization Times

Electronic Payment Fund Institutions (IFPE)

Primary Services

Minimum Capital

Authorization Times

Authorization Times

Authorization Requirements

Required Personnel

Are additional permits or authorizations required?

Who are the Involved Authorities?

Mexico: Fertile Ground for FinTech

The Problem FinTech Solves

Choose the Right Path to Market

Calculate your savings by working with Legal Paradox®

Keep an eye on your competition

Unicorns (startups valued at over $1 billion) trust Legal Paradox®

FinTech + Banking Collaboration

Do you need FinTech authorization?

Frequently Asked Questions

Key Articles of the FinTech Law

Legal Library - Official Documents

FinTech Law

Current text of the FinTech Law

General Provisions for ITFs

Provisions for IFPE

Provisions for Regulatory Sandbox

Provisions for APIs and ATMs

Circular 4/2019 - Virtual Assets

Authorization Guide for IFPE

Authorization Guide for IFC

Unicorns (startups valued at over $1 billion)
trust Legal Paradox®