Mexican Fintech Law Becomes Effective

by White & Case LLP

White & Case LLP

On March 10, 2018, the law regulating Financial Technology Institutions ("Fintech Law") became effective along with certain reforms to other financial laws.


The purpose of the Fintech Law is to create a regulatory framework applicable to persons who, through IT platforms or tools, facilitate the execution of financial transactions and services related to access to financing and investment, issuance services, administration, the redemption and transfer of electronic payment funds, and the use of virtual assets in these transactions, whether through fintech institutions ("FTI"), entities authorized to operate through regulatory sandbox models, or any authorized Mexican financial entities ("Financial Entities").

What are the Fintech Institutions?

FTIs include:

  • Crowdfunding entities engaged in connecting on a customary and professional basis, solicitors and investors of debt, equity, co-ownership or royalties funding, through electronic or digital means of communication;
  • E-money entities engaged in the issuance, administration, redemption and transfer of electronic payment funds through electronic or digital means of communication.

FTIs will only be allowed to receive funds directly from deposit accounts maintained at Financial Entities, and must deliver the funds to their clients through payments or transfers to accounts maintained at Financial Entities. With prior authorization from the Mexican Banking and Securities Commission ("CNBV") FTIs will be able to receive cash or transfers from foreign financial institutions or other similar entities.

Who can operate as an FTI?

Mexican corporations (sociedades anónimas) that comply with the requirements determined by the Fintech Law and that obtain the discretionary authorization from the CNBV can operate as an FTI, with the prior consent from the Inter-institutional Committee created by the Fintech Law. These must be domiciled in Mexico and comply with the minimum capital requirements to be determined by the enabling regulations.

Transactions performed through FTIs will not be secured by any guaranty from, or be subject to any obligation by governmental agencies.

What happens if you are currently carrying out activities regulated by the Fintech Law?

Persons who are already carrying out activities regulated by the Fintech Law must submit to the CNBV a request for authorization within 12 months from the effective date of the applicable enabling regulations. This shall be issued within the six months following the effective date of the Fintech Law. During the term in which the CNBV reviews their authorization requests, such persons may continue to perform such activities, so long as, from the date the Fintech Law becomes effective, they disclose through their website or other media that their authorizations are in process and that their activities are not supervised by the Mexican authorities.

Cryptocurrency Transactions

The Fintech Law governs, for the first time, transactions performed through virtual assets, typically known as "cryptocurrencies". Legal currency in Mexico, foreign exchange or other assets denominated in Mexican currency or foreign exchange shall not be deemed cryptocurrencies. FTIs may only operate with virtual assets authorized by the Mexican Central Bank (Banco de México), under the terms and conditions it eventually determines under enabling regulations. Banking institutions may carry out transactions with the virtual assets determined by the Mexican Central Bank through enabling regulation, with the prior authorization of the Mexican Central Bank.

Regulatory Sandbox

The Fintech Law includes an option to obtain a special temporary authorization to offer financial services using technological tools or media through other than existing mechanisms (typically known as regulatory sandbox), subject to certain terms and conditions. The concept of the regulatory sandbox has promoted the development of technological platforms in other jurisdictions.

Application Programming Interfaces (APIs)

The Fintech Law requires Financial Entities and FTIs, among others, to establish application programming interfaces ("APIs") to allow connectivity and access to interfaces developed or managed by other Financial Entities and FTIs (with the prior consent of users). Their purpose is to share users’ open financial, aggregate and transactional data, which would not constitute a violation of financial secrecy obligations. Financial Entities and FTIs interested in gaining access to such information will need the prior authorization of their corresponding supervisory commissions, which will also authorize the fees to be charged by Financial Entities and FTIs for the exchange of such information through APIs, for the purpose of preventing such fees from becoming entry barriers.

The standards for the exchange of data and information through APIs shall be subject to enabling regulations to be issued by the corresponding supervisory commissions

Automated Investment Advice (Robo Advisors)

As part of the financial technology reform, the Mexican Securities Market Law was amended to allow automated investment and asset management advice. Enabling regulations will determine the special rules applicable to advice given through these mechanisms.

Financial Innovation Group

The Financial Innovation Group (Grupo de Innovación Financiera) was created as a consultation and advice forum to share ideas and discuss innovations in the financial arena between the private and public sectors, to achieve better planning, development and regulation. This group comprises representatives from both sectors, ensuring the participation of the FTIs and Financial Entities communities.

What are the consequences of the Fintech Law for Financial Entities?

Financial Entities will need a special authorization from their relevant regulators to participate in the capital stock of FTIs and will differentiate the personnel and marketing channels they use for their own activities. Client Alert White & Case 3 Financial Entities may agree with FTIs that have capital stock in which they participate to provide them with technological infrastructure and ancillary services to support the FTI’s operations, with the prior authorization from the CNBV (complying with the conditions and criteria established by the enabling regulation).

Also, subject to enabling regulations, Financial Entities will establish APIs allowing connectivity and access to other APIs developed or managed by entities that obtain the corresponding authorization from the respective supervisory commissions.

When will the enabling regulations be published?

Several provisions of the Fintech Law require further development through enabling regulation. The CNBV, the Mexican Central Bank and other financial authorities are required to publish the corresponding enabling regulations within the six,12 and 24 month periods following the Fintech Law’s effective date.

Click here to download PDF.

Giampiero Bellucci, Legal Intern at White & Case, assisted in the development of this publication.

[View source.]

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© White & Case LLP | Attorney Advertising

Written by:

White & Case LLP

White & Case LLP on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
Sign up using*

Already signed up? Log in here

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
Privacy Policy (Updated: October 8, 2015):

JD Supra provides users with access to its legal industry publishing services (the "Service") through its website (the "Website") as well as through other sources. Our policies with regard to data collection and use of personal information of users of the Service, regardless of the manner in which users access the Service, and visitors to the Website are set forth in this statement ("Policy"). By using the Service, you signify your acceptance of this Policy.

Information Collection and Use by JD Supra

JD Supra collects users' names, companies, titles, e-mail address and industry. JD Supra also tracks the pages that users visit, logs IP addresses and aggregates non-personally identifiable user data and browser type. This data is gathered using cookies and other technologies.

The information and data collected is used to authenticate users and to send notifications relating to the Service, including email alerts to which users have subscribed; to manage the Service and Website, to improve the Service and to customize the user's experience. This information is also provided to the authors of the content to give them insight into their readership and help them to improve their content, so that it is most useful for our users.

JD Supra does not sell, rent or otherwise provide your details to third parties, other than to the authors of the content on JD Supra.

If you prefer not to enable cookies, you may change your browser settings to disable cookies; however, please note that rejecting cookies while visiting the Website may result in certain parts of the Website not operating correctly or as efficiently as if cookies were allowed.

Email Choice/Opt-out

Users who opt in to receive emails may choose to no longer receive e-mail updates and newsletters by selecting the "opt-out of future email" option in the email they receive from JD Supra or in their JD Supra account management screen.


JD Supra takes reasonable precautions to insure that user information is kept private. We restrict access to user information to those individuals who reasonably need access to perform their job functions, such as our third party email service, customer service personnel and technical staff. However, please note that no method of transmitting or storing data is completely secure and we cannot guarantee the security of user information. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of user information at any time.

If you have reason to believe that your interaction with us is no longer secure, you must immediately notify us of the problem by contacting us at In the unlikely event that we believe that the security of your user information in our possession or control may have been compromised, we may seek to notify you of that development and, if so, will endeavor to do so as promptly as practicable under the circumstances.

Sharing and Disclosure of Information JD Supra Collects

Except as otherwise described in this privacy statement, JD Supra will not disclose personal information to any third party unless we believe that disclosure is necessary to: (1) comply with applicable laws; (2) respond to governmental inquiries or requests; (3) comply with valid legal process; (4) protect the rights, privacy, safety or property of JD Supra, users of the Service, Website visitors or the public; (5) permit us to pursue available remedies or limit the damages that we may sustain; and (6) enforce our Terms & Conditions of Use.

In the event there is a change in the corporate structure of JD Supra such as, but not limited to, merger, consolidation, sale, liquidation or transfer of substantial assets, JD Supra may, in its sole discretion, transfer, sell or assign information collected on and through the Service to one or more affiliated or unaffiliated third parties.

Links to Other Websites

This Website and the Service may contain links to other websites. The operator of such other websites may collect information about you, including through cookies or other technologies. If you are using the Service through the Website and link to another site, you will leave the Website and this Policy will not apply to your use of and activity on those other sites. We encourage you to read the legal notices posted on those sites, including their privacy policies. We shall have no responsibility or liability for your visitation to, and the data collection and use practices of, such other sites. This Policy applies solely to the information collected in connection with your use of this Website and does not apply to any practices conducted offline or in connection with any other websites.

Changes in Our Privacy Policy

We reserve the right to change this Policy at any time. Please refer to the date at the top of this page to determine when this Policy was last revised. Any changes to our privacy policy will become effective upon posting of the revised policy on the Website. By continuing to use the Service or Website following such changes, you will be deemed to have agreed to such changes. If you do not agree with the terms of this Policy, as it may be amended from time to time, in whole or part, please do not continue using the Service or the Website.

Contacting JD Supra

If you have any questions about this privacy statement, the practices of this site, your dealings with this Web site, or if you would like to change any of the information you have provided to us, please contact us at:

- hide
*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.