Mexico has been ravaged by the COVID-19 pandemic, which has led to one of the world’s highest death tolls, destabilized development goals and battered the economy. The Mexican economy, the fifteenth largest in the world and the second largest in Latin America,1 plunged by 8.3% in 2020,2 its largest contraction since the Great Depression.3 Average income dipped by 7% in 2020 from 2018,4 and 3.8 million Mexicans were driven into poverty.5 The International Monetary Fund (IMF) forecasts a growth rate of 6.3% in 2021,6 but surging infections could endanger the emerging market’s fragile recovery.&
Digitalization will be key in securing Mexico’s post-pandemic recovery, strengthening its regional and global competitiveness, and reaching its poverty reduction goals. Although Mexico scores low on digital evolution momentum per the Digital Intelligence Index (DII) 2020, developed by Tufts University’s Fletcher School and Mastercard, its citizens are increasingly technology engaged. The Mexican population is young and tech-savvy, citizens and businesses have flocked to digital solutions amidst the health crisis, and fintech is well-positioned for growth. Foreign direct investment rose by 6.6% in 2020 from 2019,7 the fintech startup ecosystem grew by 14% in 2020 from 20198 and biometric applications have been increasingly adopted.9 Ninety-three fintech companies are in the process of acquiring a Financial Technology Institution (FTI) license10 per the 2018 Law to Regulate Financial Technology Institutions (the “Fintech Law”).
Although the Mexican government has been slow to nurture the digital economy, it has the opportunity to partner with this increasingly sophisticated fintech sector in spearheading longstanding goals like financial inclusion. A mere 37% of Mexican adults have a bank account, only 32% have utilized digital payments and lack of access to credit persists, all of which are compounded across geographic and gender divides.11 Digital onboarding has promoted financial inclusion in Mexico, but the process requires fine-tuning; fintech could be instrumental in making banking cheaper, faster, more convenient and more accessible.
Beyond financial inclusion, Mexico’s 2021 digital agenda focuses on promoting digital payments, strengthening the national AML/CTF framework, developing the fintech ecosystem and open banking, and rolling out a national digital ID system. In laying the foundation for a competitive, modern and inclusive digital economy, regulators must look to support small and medium-sized enterprises, strengthen digital infrastructure and promote use of the Cobro Digital Collection and Payment Platform (CoDi). As digital transformation accelerates, regulators must also ensure that stronger national cybersecurity measures are implemented.
Financial Regulatory Authorities
The Bank of Mexico (Banxico) is the central bank of Mexico and the country’s primary monetary authority.
The National Institute of Transparency for Access to Information and Personal Data Protection (INAI) is the independent data protection agency of Mexico. The INAI is constitutionally mandated to defend and expand the right of access to public information and the protection of personal data.
The Secretariat of the Economy (SE) is the federal government office responsible for all matters related to Mexico’s economy and commercial industries. Additionally, the SE issues guidelines regarding privacy notice requirements in partnership with the INAI.
The Secretariat of Finance and Public Credit (SHCP) houses the country’s finance ministry and operates as a member of the federal executive cabinet. The SHCP is the head of the Office for the Treasury and Public Credit.
The National Banking and Securities Commission (CNBV) is an independent agency operating under the Secretariat of Finance and Public Credit and is the executive authority supervising Mexico’s financial system. The CNBV is technically autonomous and regulates financial institutions and banks to ensure national financial system stability.
Policy, Laws and Regulations
Banxico, the Finance Ministry and CNBV issued a joint statement noting that cryptocurrency is not legal tender and that financial institutions are not authorized to offer services involving cryptocurrency. Financial institutions that do so are subject to sanctions. Per the Fintech Law, credit institutions may carry out certain internal operations using virtual assets, but these must be prescribed in provisions issued by Banxico. Banxico must then grant prior authorization to institutions looking to conduct operations with virtual assets. The statement also notes that entities conducting operations utilizing stablecoins must first obtain authorization from Banxico. The regulators address the volatility in cryptocurrency, its lack of inherent value and its speculative nature.
Cryptocurrency use has soared in Mexico, home to Latin America’s largest cryptocurrency platform and its first crypto unicorn, Bitso.12
The provisions of the Law to Regulate Financial Technology Institutions relevant to electronic payment fund institutions (EPFIs) have gone into effect. EPFIs must obtain users’ express consent through an authentication process upon entering into an agreement. Users must be informed of the inherent risks in the use of the platforms, as well as recommendations on preventing unauthorized actions, and terms and conditions must be available at any moment for users’ viewing. If the user wishes to contract operations and services other than those originally agreed upon, the terms and conditions shall be modified with express consent of the user. EPFIs must also notify users, in a period not exceeding five seconds, in the case that certain operations are executed:
- The daily accumulated amount of operations exceeds the equivalent in national currency to 60 investment units, or an individual operation exceeds the equivalent in national currency to 25 investment units
- “Registration or modification of the means of notification” to the user
- The contracting of another service
- “Deactivation, blocking, reactivation and modification of the authentication factors.”
The 2018 Fintech Law, which regulates EPFIs and crowdfunding institutions, aims to develop innovative companies in Mexico. It established an open banking regulatory regime and a licensing regime, and allows for regulated entities to perform certain internal operations with the use of virtual assets, upon authorization by Banxico. Though Mexico was the first Latin American country to introduce an open banking framework, it has been slow to enact provisions.13
National Registry of Mobile Phone Users to Collect Biometric Data, 13 April 2021
The Senate approved the passage of a reform to the Federal Telecommunications and Broadcasting Law, which will establish a national registry of mobile phone users and their biometric data. When citizens purchase a SIM card or activate a prepaid mobile phone, they will be required to present their ID, proof of address and one biometric identification, which can include fingerprints, an iris scan or facial features.14 Once the Federal Telecommunications Institute has issued the administrative provisions in the establishment of the registry, mobile phone users will have two years to register and submit their biometric data, or their phone service will be cancelled.15
Implementation of Databases Containing Biometric Data, 31 March 2021
Effective 31 March 2021, banks must establish databases containing customers’ biometric data, including at least fingerprints. The databases will eventually expand to include facial and voice data, with the possibility of iris data, by 2023.16 Although the move aims to strengthen security, Mexican financial institutions remain vulnerable to cyberthreats. In January 2021, databases of Santander, BBVA and the Mexican Institute of Social Security were leaked and put up for sale online.17 A compromise of biometric data could prove even more devastating. Mexico does not have a national cybersecurity law,18 and the government has been slow to release information about past cyberattacks, which has left private companies less equipped to bolster cybersecurity measures.19 From 01 November 2020 to 31 January 2021, the Mexican government led a National Anti-Cyber Fraud Campaign, which sought to raise awareness and boost cooperation between the government and society.
Requirement on the Collection and Storage of Geolocation Data, 23 March 2021
Effective 23 March 2021, financial institutions must collect and store customers’ real-time geolocation data in the cases of account opening, entry into contracts and operations conducted on digital platforms. Customers must provide consent for the collection and storage of their real-time geolocation data, or else be denied access.20 The move comes as part of Mexico’s efforts to bolster AML/CTF and aligns with recommendations from the Financial Action Task Force (FATF). CNBV noted in a statement that geolocation “is intended to have a client risk indicator that allows financial institutions to obtain information on the geographical area when executing non-face-to-face operations that are carried out on devices that the client has in their possession and from those whose location is unknown.”21 On 20 March 2021, the National Institute of Transparency, Access to Information and Protection of Personal Data (INAI) released a statement entreating financial institutions to exercise extreme caution in the processing of customers’ real-time geolocation data.
National Digital ID System, 03 December 2020
The Chamber of Deputies approved the passage of the General Law on Population, Human Mobility and Interculturality, which will establish a national digital ID system. The Cédula Única de Identidad Digital (Unique Digital Identity Card), to be issued by the Mexican Secretariat for Home Affairs (SEGOB), will be the official ID document for all Mexican citizens. Available in both physical and electronic formats, the ID will include citizens’ names, date and place of birth, nationality, biometric data and Population Registration Key (CURP) number. The ID will also note whether the holder belongs to an Indigenous or Afro-Mexican community.
1. “The World Bank in Mexico.” The World Bank, 29 March 2021. https://www.worldbank.org/en/country/mexico/overview
2. Zaga, Daniel et al. “Mexico: An exports-led recovery.” Deloitte, 17 June 2021. https://www2.deloitte.com/us/en/insights/economy/americas/mexico-economic-outlook.html
3. Graham, Dave. “Mexico's economy in 2020 suffers worst slump since 1930s.” Reuters, 29 January 2021. https://www.reuters.com/article/us-mexico-economy-gdp-idUSKBN29Y1OF
4. “Poverty increases in Mexico amid COVID-19 pandemic.” The Washington Post, 05 August 2021. https://www.washingtonpost.com/world/poverty-increases-in-mexico-amid-covid-19-pandemic/2021/08/05/ebd45206-f62b-11eb-a636-18cac59a98dc_story.html
5. “Pandemic drove 3.8 million more Mexicans into poverty status: Coneval report 2018-2020.” The Yucatan Times, 06 August 2021. https://www.theyucatantimes.com/2021/08/pandemic-drove-3-8-million-more-mexicans-into-poverty-status-coneval-report-2018-2020/
6. “Mexico.” International Monetary Fund. https://www.imf.org/en/Countries/MEX
7. “Foreign Direct Investment in Latin America and the Caribbean.” The Economic Commission for Latin America and the Caribbean, 05 August 2021. https://repositorio.cepal.org/bitstream/handle/11362/47148/1/S2100464_en.pdf
8. Arce Lozano, René and Dinorah Cantu. “Mexico: The Mexican Fintech Ecosystem.” Mondaq, 01 March 2021. https://www.mondaq.com/mexico/fin-tech/1041174/the-mexican-fintech-ecosystem
9. Mascellino, Alessandro. “Mexico approves rollout of national biometric digital ID card.” Biometric Update, 07 December 2020. https://www.biometricupdate.com/202012/mexico-approves-rollout-of-national-biometric-digital-id-card
10. “Latin America Sees Booming Digital Banking Sector with Brazil at the Lead.” FintechNews, 19 July 2021. https://fintechnews.ch/latin-america/latin-america-sees-booming-digital-banking-sector-with-brazil-at-the-lead/47312/
11. Belmont, Jessica. “Expanding Financial Access for Mexico’s Poor and Supporting Economic Sustainability.” The World Bank, 09 April 2021. https://www.worldbank.org/en/results/2021/04/09/expanding-financial-access-for-mexico-s-poor-and-supporting-economic-sustainability
12. Bambysheva, Nina and Maria Abreu. “Mexican Bitcoin Exchange Bitso Raises $250 Million, Becomes Latin America’s First Crypto Unicorn.” Forbes, 05 May 2021. https://www.forbes.com/sites/ninabambysheva/2021/05/05/mexican-bitcoin-exchange-bitso-raises-250-million-becomes-latin-americas-first-crypto-unicorn/?sh=2ca0e37764af
13. Seminario, Fabiola. “Open Banking in LatAm: The State of Play.” iupana, 22 February 2021. https://iupana.com/2021/02/22/open-banking-in-latam/?lang=en&utm_source=iupana&utm_medium=email&utm_campaign=210802EN
14. “Senate approves cell phone users registry that will collect biometric data.” Mexico News Daily, 14 April 2021. https://mexiconewsdaily.com/news/senate-approves-biometric-cell-phone-users-registry/
15. “Cell Phone Users in Mexico Have Two Years to Submit Their Biometric Data to the Government or Lose Service.” Vallarta Daily, 17 April 2021. https://www.vallartadaily.com/cell-phone-users-in-mexico-have-two-years-to-submit-their-biometric-data-to-the-government-or-lose-service/
16. Young, James. “Mexican banks implement digital security requirements.” BNamericas, 25 March 2021. https://app.bnamericas.com/article/section/all/content/xddfqszi4-biometrics-next-in-mexico-banking-security-regulatory-rollout
17. “Data breaches in Mexico raises concerns about biometric requirements.” NewTechMag.Net, 03 February 2021. http://newtechmag.net/2021/02/03/data-breaches-in-mexico-raises-concerns-about-biometric-requirements/
18. Lechuga Perezanta, Cesar Armando. “Data Protection and Cybersecurity Laws in Mexico.” CMS, 19 February 2021. https://cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-security-laws/mexico
19. Rodríguez, Ariel. “What are Mexico’s public sector vulnerabilities to cyber attacks?” BNamericas, 29 January 2021. https://app.bnamericas.com/article/section/all/content/x0f4bjibw-what-are-mexicos-public-sector-vulnerabilities-to-cyber-attacks
20. Young, James. “Mexico banking watch: Geo-location rule, Sabadell unit, NBFI update.” BNamericas, 19 March 2021. https://app.bnamericas.com/article/section/all/content/xb66dpzks-banking-watch-mex-geo-location-requirement-going-into-effect-march-23
21. Young, James. “Mexican banks implement digital security requirements.” BNamericas, 25 March 2021. https://app.bnamericas.com/article/section/all/content/xddfqszi4-biometrics-next-in-mexico-banking-security-regulatory-rollout
*DISCLAIMER: This information is OneSpan's interpretation of the compliance requirements as of the date of publication. Please note that not all interpretations or requirements of the applicable laws are well-settled and its application is fact- and context-specific. The information contained in this document should not be relied upon as legal advice or to determine how the law applies to your business or organization. We encourage you to seek guidance from your legal counsel with regard to law applying specifically to your business or organization and how to ensure compliance. This information is provided “as-is” and may be updated or changed without notice. OneSpan does not accept liability for the contents of these materials.
Last updated: November 2021