The publication of the Financial Technology Institutions Law (Fintech Law) on 9 March, 2018 was a long awaited piece of legislation which aimed to promote financial inclusivity and technological innovation through a joint collaboration between Mexican regulators, legislators, and important private actors in the field. This article considers the requirements under the Fintech Law that any third country entities will need to comply with in order to operate in Mexico in this space.

The Fintech Law intends to build a regulatory framework aimed at the development of innovative financial services, increasing the level of competition and financial inclusion, as well as placing Mexico at the forefront of the industry. The Fintech Law currently recognizes two types of financial technology institutions (FTI) and an innovative or sandbox model:

  1. crowdfunding institutions;
  2. electronic money institutions (EMI); and
  3. the innovative model.

The first of the recognized FTIs, crowdfunding institutions, connect people so that investors can fund investment seekers through mobile applications, interfaces, websites or any other means of electronic or digital communications. EMIs on the other hand offer services of issuance, management, accountability and transfer of electronic payments. The funds recorded in an electronic transaction accounting ledger and kept by an EMI will be considered as electronic payment funds.

The Fintech Law also establishes the possibility of operating on a temporary basis under an innovative model, namely institutions that provide financial services through technological tools with different characteristics to the ones available in the market. A temporary authorization will be granted to this type of FTI, in compliance with the Fintech Law.

As a matter of law, any entity that wishes to operate as an FTI will need to file for authorization to operate as an FTI with the National Banking and Securities Commission (known by its acronym in Spanish as CNBV).

This means that international entities—even those that are already a Fintech company in their jurisdiction—who wish to incorporate and operate as an FTI in Mexico need to file for an authorization with the CNBV. International entities should therefore bear in mind that in order to operate in Mexico, all their activities should be conducted through an authorized FTI.

Under the Fintech Law, EMIs are allowed to outsource services, domestic or foreign, to third-party providers as needed in order to successfully carry out and fulfill their operations (Outsourced Services).

A foreign corporation may therefore lend their international service-provider platform as an Outsourced Service to EMIs in order for them to carry out their day-to-day activities. The result of this is that even though an EMI will always be the entity to have the legal relationship with the client (marketing, contracting, liability, etc.), EMIs may use the Outsourced Services of a foreign Fintech platform to their advantage.

The Fintech Law also states that third-party service providers are not exempt from complying with certain provisions of the Fintech Law. These provisions serve the purpose of making EMIs—or any other FTIs for that matter—the party facing the client, and not any other third party which may be carrying out services for an EMI related to electronic fund transfer operations. Set out below are the main requirements under the Fintech Law that foreign third party service providers should bear in mind.


Financial authorities such as the CNBV and Bank of Mexico are empowered to supervise third-party service providers hired by EMIs at all times. Such supervising powers include the ability of the CNBV and Bank of Mexico to request for audits to be performed by EMIs on their third-party service providers. The purpose of any inspection or audit request will have to be specified and its scope limited to the contracted service, compliant with the provisions of the Fintech Law and its secondary regulation.

Publicity requirements

With regards publicity requirements for EMIs, the Fintech Law requires such institutions to be transparent about certain relevant aspects with their clients and investors. Of particular note is the provision that requires EMIs, including all other FTIs, to expressly state that no government entity will guarantee or be accountable for any funds or assets used in any operation entered into with an EMI. Such statements must be communicated to clients through the relevant EMI's respective webpages, their digital applications and other means of electronic communication, as well as in the advertising and the contractual documentation they enter into with their clients.

The Fintech Law also has strict requirements regarding company names and expressly prohibits the use of any of the acronyms associated with financial technology institutions without permission. Authorized FTIs, however, must include "electronic money institutions" or "crowdfunding institutions" in their company name, as relevant.

Client classification

Under the Fintech Law, EMIs are required to classify customers depending on their risk level. The customer's risk level will depend on the result of due diligence procedures undertaken at the moment of account creation and the subsequent transaction limits set for each customer.

The general provisions regarding AML/KYC determine that level 1 and level 2 customers are low risk and therefore have simpler due diligence procedures. For level 1 customers, operations are limited to approximately US$2501 per month and for level 2 customers, operations are limited to approximately US$985 per month. These types of accounts also have more lenient information requirements, which is one of their main advantages.

Fund transfers

With regards to limits on fund transfers, EMIs must request authorization from the CNBV to receive or transfer cash funds in Mexican Pesos (MXN) to or from their clients. The limits for cash deposits per client are US$3,290 per month and the cash withdrawal is limited to US$490 per day per client.

Furthermore, fund transfers in national or foreign currency, to or from deposit accounts opened in foreign financial entities are limited to US$550 per month per client for accounts classified as low risk in accordance with the current regulation. Transactions for individuals are limited to US$10,000 per month, whereas for corporations there are no amount limits on international fund transfers.

Final thoughts

In conclusion, a Fintech foreign investor that is considering doing business in Mexico should bear in mind the various requirements set out in the Fintech Law that will need to be met regarding client relationship, publicity, and money transfers.


1. All amounts are indexed to the Investment Units value ("UDIs") (Unidad de Inversión) and are subject to change in time. UDIs value is reported by Banxico on a daily basis.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.