How we measure CNBV authorization timelines

An authorization timeline is a fact about a process that already ended. It is not a deadline the regulator promises, and it is not a result a law firm can guarantee. This page explains how the Legal Paradox® Regulatory Intelligence Index is built, where every number comes from, what it can and cannot tell you, and how to check it yourself. The index is published at mapafintech.com/dashboard; it is maintained by Legal Paradox® and is not an official statistic of the Comisión Nacional Bancaria y de Valores (CNBV).

What the index measures

The index documents authorizations of Financial Technology Institutions (ITF) in Mexico since the Fintech Law took effect in 2018: Electronic Payment Fund Institutions (IFPE) and Crowdfunding Institutions (IFC), together with SOFIPO and banking authorizations relevant to the same market. Each row is one authorization published in the Diario Oficial de la Federación (DOF). Withdrawn or denied applications, and conditional authorizations that were never published, are not rows, because the DOF is the only public act that fixes an end date. The index therefore describes what the regulator authorized, not everything that was applied for.

At the current build the dataset holds 98 authorization records. Of these, 89 are ITF authorizations (62 IFPE and 27 IFC through the end of 2025, consistent with the figures reported from Banco de México and CNBV data); the rest are SOFIPO and banking entries. No Innovative Model (regulatory sandbox) authorization has been granted to date.

Definitions

Start date: the application date recorded in CNBV public registries or stated in the authorization document itself. End date: the date the authorization is published in the DOF. Days are calendar days between those two dates. The interval measures elapsed time, including any period in which the applicant was responding to observation letters; it does not measure how long the regulator was actively working on the file.

Market average: the mean of all documented authorizations of a given type, weighted by sector. The IFPE market average is 787 days; the IFC market average is 896 days. The longest IFPE authorization on record took 1,766 days (Moneypool, DOF 26 July 2024); the longest of any ITF, 1,785 days (Afluenta, IFC, DOF 12 August 2024).

Legal Paradox® results: the figures we publish for our own work are single, dated authorizations, not averages. The most recent IFPE authorization we prepared was granted in 416 days (Sylon, DOF 10 April 2023); the most recent IFC, in 418 days (Inverteca, DOF 10 April 2023). Against the market averages those are 47% and 53% faster. They are two files, each verifiable in the DOF, and they predate our current production stack.

Sources and cut-off

Every row is built from the DOF publication, the CNBV registry of supervised entities and, where relevant, Banco de México materials and the compliance matrices we maintain for each entity type. Each record links to its DOF publication so that any reader can check the end date without relying on our presentation.

The index is rebuilt whenever a new authorization is published in the DOF. Each build is dated, and the latest authorization recorded is shown next to it, so you always know which version you are reading. Current build: 8 August 2026. Latest authorization recorded: 15 October 2025 (Moneki, IFPE). No initial ITF authorization was published in the DOF between that date and the build date; the DOF entries in that window concern amendments to existing authorizations.

Why other published averages differ

You will find other averages in circulation: 809 days, reported by Latam Fintech Hub citing a CNBV communication; 815 days, published by El Economista in August 2024, which also reported the 1,766-day maximum; 855 days, published by El CEO in March 2026. None of them contradicts the index. They differ because the universe (IFPE only, or all ITF), the observation window and the definition of the start date differ. A single case can also sit far from any average: Finco Pay was authorized in 566 days (DOF 16 June 2025) and Moneki in 574 (October 2025).

The most useful independent reference is the audit of the CNBV by the Auditoría Superior de la Federación (audit 2023-5-06B00-07-0080-2024, Cuenta Pública 2023, “Regulación y Supervisión de las Instituciones de Fondos de Pago Electrónico”). The ASF reviewed the 23 IFPE authorizations granted in 2023: thirteen took between 1,248 and 1,542 days, nine between 405 and 445, and one 30 days; it also records that no resolution deadline existed until the CNBV’s November 2023 manual introduced a 180-calendar-day term. The two authorizations we cite above, Sylon and Inverteca, were granted in April 2023 and sit inside the 405–445-day cluster the ASF documented. That is the only external validation we claim for them.

What our 416 and 418 mean, and what they don’t

Three clocks run in every authorization, and only one of them is the regulator’s.

File preparation (ours): what used to take eight lawyers up to eight months now takes about one week, depending on the type of financial entity. Responses to CNBV observation letters (ours): from roughly six weeks to 24 hours. The regulator’s authorization process (not ours): the most recent IFPE authorization we prepared was granted in 416 days (Sylon, DOF 10 April 2023) against a 787-day market average, and the most recent IFC in 418 days (Inverteca, DOF 10 April 2023) against 896, measured from DOF publications. Those are single, dated results, 47% and 53% faster than the market average, not averages of our files, and they predate our full current stack; no complete file has yet run end to end on it.

None of this is a forecast. A well-prepared file shortens the parts of the process that depend on the applicant; it does not control the regulator’s calendar, its workload or a change of administration.

Known limitations

The index depends on public application dates; where the CNBV registry and the DOF disagree, the DOF governs and the discrepancy is noted in the record. It does not adjust for the number or length of observation letters, and it does not separate periods under different CNBV administrations, although those periods are visible in the data. It cannot describe how long unsuccessful or withdrawn applications took, because they never reach the DOF. And the two results we publish for our own work are exactly that: two results, dated, not a statistical sample.

Access the data

Dashboard: mapafintech.com/dashboard. Machine-readable dataset: mapafintech.com/api/dashboard.json. License: Creative Commons BY-NC 4.0. Suggested citation: “Legal Paradox® Regulatory Intelligence Index, dataset build 8 August 2026”, with the access date and the entity type cited.

Frequently asked questions

Is this an official CNBV statistic?No. It is an index maintained by Legal Paradox® from public records: the DOF, the CNBV registry and Banco de México materials. Public sources do not make it an official figure, and the CNBV has not endorsed it.

Why 787 days and not 809 or 815?Because the calculations use different universes, windows and start-date definitions. The 809 figure comes from a CNBV communication reported by Latam Fintech Hub; the 815 from El Economista’s own count in August 2024. The index uses every IFPE authorization published in the DOF since 2018 and the application date on record. Compare universe, cut-off and start date before comparing the numbers.

How many Legal Paradox® files are behind the 416 days?One. The 416-day figure is the most recent IFPE authorization we prepared, Sylon, published in the DOF on 10 April 2023; the 418-day figure is the most recent IFC, Inverteca, same date. We publish them as dated results, not as averages, because that is what they are.

Can the calculation be replicated?Yes. The dataset is downloadable, every row links to its DOF publication, and the definitions above are the ones applied. If you find a row that does not match its source, write to us and we will correct the record in the next build.

How often is it updated?Whenever a new authorization is published in the DOF. Each build carries its date and the latest authorization it contains.