The Origin of the Fintech Law: From the Gray Area to the Major Leagues

2008 - 2016: The Problem.

It all began when players such as Prestadero, Bitso, the Fintech Association of Mexico, and Afico recognized that the activities they were performing were in a gray area. It was possible to argue that these were regulated financial activities reserved solely for authorized entities.

The consequences could be devastating: millions in fines and even up to 15 years in prison. For entrepreneurs recognized internationally as great innovators, this represented a real risk.

During 2017, approximately 35% of Mexican FinTechs were being investigated for potential illegal deposit-taking (the unauthorized collection of funds from the public).

Our first client at Legal Paradox® was one of those entrepreneurs whom we, fortunately, brought out safe and sound without a single fine, let alone prison time.

2016-2018: The Solution.

As a collective, we approached the financial regulator and requested to be regulated. Fortunately, we met with receptive authorities who held more than 270 meetings so we could explain:

(i) What we were doing; 

(ii) What the risks were and how they were being mitigated; and

(iii) Why our activity was different and desirable for financial inclusion (the process of ensuring access to financial services for all segments of society).

Our goal was clear: to leave the gray area and move into the major leagues.

On March 9, 2018, the FinTech Law was published after being signed during the inaugural session of the 81st Banking Convention. With this, Mexico became the first country in the world with a specific regulatory framework to promote innovation in financial services.

What is the FinTech Law?

The Law to Regulate Financial Technology Institutions (known as the "FinTech Law") is the regulatory framework that governs financial technology companies in Mexico.

‍With this legislation, Mexico not only moved ahead of its contemporaries but also set a standard for the region, enabling FinTechs to experiment and grow under the watchful eye of regulators.

Main Objective

The purpose of the Law is to regulate the financial services provided by ITFs (Financial Technology Institutions), as well as their organization, operation, and functioning, in addition to financial services subject to special regulations offered or carried out through innovative means.

Who does it apply to?

The Mexican FinTech Law applies to:

• Instituciones de Financiamiento Colectivo (IFC) — Crowdfunding (platforms that connect investors with applicants for debt or equity financing)
  

• Instituciones de Fondos de Pago Electrónico (IFPE) — Digital Wallets
  

• Companies authorized to operate Innovative Models (Sandbox) — (a controlled environment for testing innovative financial services with temporary licenses)
  

• Financial entities operating with virtual assets — (cryptocurrencies and digital assets regulated under the central bank's framework)
  

• Third parties providing services to ITFs — (Financial Technology Institutions)
  

• All Mexican Financial Entities for the purposes of Open Finance — (the mandatory sharing of data between institutions through secure technology)
  

Authorization Requirements

The application must include (Article 39 of the LRITF, the Law to Regulate Financial Technology Institutions), among others:

• Powers of attorney for the promoters' representatives
  

• Draft bylaws or their amendment (estatutos sociales, the constitutional documents that govern a company's internal structure and rules).
  

• Business plan with financial projections
  

• Client account segregation policies
  

• Risk disclosure and liability policies
  

• Information security and confidentiality measures
  

• KYC (know-your-customer, client identification processes)
  

• Conflict of interest policies
  

• Fraud prevention policies
  

• Agreements with technology providers
  

• Business continuity policies (contingency plans designed to ensure that essential business functions can continue to operate during and after a disaster or disruption)
  

• Model agreement (standardized contract) for clients
  

• Shareholder and administrator information (the detailed identification and background documentation for those who own or manage the entity)
  

• Domicile within national territory
  

• Financial feasibility study
  

• Over 50 highly technical documents
  

Required Personnel

• Compliance Officer certified by the CNBV (National Banking and Securities Commission, the federal regulator of the Mexican financial system)
  

• In the event of having a Board of Directors, at least 20% must be independent members.  
  

• A law firm of recognized prestige in the shareholders' country of origin (such as Legal Paradox®, which is recognized by the financial regulator as the
  FinTech Lawyers).
  

• CISO (Chief Information Security Officer) (the CEO may fulfill this role for up to 12 months, starting from the date the authorization is obtained).
  

• Auditor to validate financial information and technological infrastructure (pentest, penetration testing to evaluate system security).
  

• Development team (Highly desirable).
  

Are additional permits or authorizations required?

• Foreign currency transfers: Specific authorizations for managing accounts or transactions in currencies other than the Mexican Peso
  

• Receiving or delivering cash: Approval for physical cash handling, typically requiring specific security protocols
  

• Sending and receiving international transfers: Permits for cross-border transactions and compliance with international banking standards
  

• Foreign exchange operations: Authorizations to perform currency exchange services (buying and selling foreign currency)
  

• Use of Biometrics: Approval for the use of physiological or behavioral data (such as fingerprints or facial recognition) for client identification and authentication
  

• Contracting third parties with access to sensitive information: Regulatory vetting for outsourcing core technological or operational services that involve user data
  

• Contracting commission agents: Authorization to use third-party intermediaries (comisionistas, entities that act on behalf of the institution to provide services) to expand physical reach
  

• Direct connection to SPEI (Interbank Electronic Payment System): The high-level authorization from Banxico (The Central Bank of Mexico) to connect directly to the national real-time settlement system
  

Who are the Involved Authorities?

• National Banking and Securities Commission (CNBV)
  
  Role: Supervisory authority of ITFs (Financial Technology Institutions).
  
  Issues general provisions (secondary regulations).
  
  Imposes sanctions and revokes authorizations.
  
  At Legal Paradox®, we supported them in drafting the secondary FinTech regulation through the British-Mexican Embassy, in addition to training them on FinTech and Blockchain topics on several occasions
  

• Bank of Mexico (Banxico)
  
  Role: Regulates operations with virtual assets (cryptocurrencies) and payment systems.
  
  Authorizes operations with Virtual Assets.
  
  Regulates connection to payment systems such as SPEI (Interbank Electronic Payment System).
  
  At Legal Paradox®, we supported them with Blockchain and AI training in collaboration with Afico (the Mexican Crowdfunding Association), in addition to presenting various analyses on Virtual Assets. We also represent the Mexican consortium created to support Project Agora (a BIS-led initiative for the tokenization of bank deposits) formed by Solana, Stellar, Bitso, and Etherfuse, among others.  
  

• Ministry of Finance and Public Credit (SHCP)
  
  Role: Financial policy oversight.
  
  Presides over the Inter-institutional Committee and is in charge of the Financial Innovation Group.
  
  The SHCP has invited Legal Paradox® on several occasions to present advancements in the FinTech, Blockchain, Agrotech, and AI sectors to the Financial Innovation Group.
  

• National Commission for the Protection and Defense of Financial Services Users (Condusef)
  
  Role: Protection of financial services users.
  
  Handles user claims and complaints.
  
  Supervises adhesion contracts (standardized service agreements).
  
  At Legal Paradox®, we supported them in creating the provisions for handling complaints through electronic means.
  

FinTech + Banking Collaboration

Traditional financial entities have moved from observing FinTechs to actively forming strategic alliances.

What do sector leaders say?

Felipe Vallejo, President of the FinTech Mexico Association
‍
"Even though the operating environment is different, collaboration has broad potential. We both face the same challenges and are trying to solve the same problems."

Angélica Arana, CIO at Banco Multiva

"FinTechs have disrupted the financial sector, challenging the status quo. Competition is healthy, and the synergies between FinTechs and banks have yielded very good results."