Payments and payment systems are regulated by several federal laws and regulations. The main laws governing payments and payment systems in Mexico are: the Mexican Constitution, the Law of Payment Systems (Ley de Sistemas de Pago), the Central Bank Law (Ley del Banco de México), the Law for the Transparency and Order of Financial Services (Ley para la Transparencia y Ordenamiento de los Servicios Financieros), and the Law to Regulate Financial Technology Institutions (Ley para Regular las Instituciones de Tecnología Financiera, the “Fintech Law”). The constitution grants the Mexican Central Bank (Banco de México, “Banxico”) constitutional autonomy and the authority to, among others, regulate financial services in Mexico. As a result, the Central Bank Law stipulates Banxico’s main purposes, which include ensuring that the Mexican payment systems function correctly. The Law of Payment Systems sets out the requirements for a payment system to be considered systemically relevant, Banxico’s broad authority to regulate and supervise such systems, and a framework for the clearing and settlement of transactions through such systems. The Law for the Transparency and Order of the Financial Services provides Banxico and the National Banking and Securities Commission (Comisión Nacional Bancaria y de Valores, “CNBV”) with additional tools to regulate payment systems and promote their transparency and competitiveness, including the regulation of fees charged by the participants of card networks. The Fintech Law introduces electronic payment funds institutions (instituciones de fondos de pagos electrónicos, “IFPEs”), whose main purpose includes maintaining e-wallets on behalf of their clients. Relevant secondary regulation issued by Banxico and/or by CNBV include: (i) Rule (Circular) 14/2017, which regulates the Mexican Peso denominated Interbank Electronic Payments System (SPEI) (amended in 2022 to regulate the indirect participation of financial entities in SPEI and improve the experience of its users); (ii) the regulations applicable to the participants of the payment disposal network (Disposiciones de carácter general aplicables a las Redes de Medios de Disposición), which specifically regulate card networks (the “Payment Regulations”); and (iii) the regulations applicable to IFPEs (Disposiciones de carácter general aplicables a las Instituciones de Tecnología Financiera and Disposiciones de carácter general aplicables a las Instituciones de Fondos de Pago Electrónico). The Anti-Money Laundering Law (Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita, the “AML Law”), its regulations and interpretative notes by the Financial Intelligence Unit (Unidad de Inteligencia Financiera) also apply to payment systems, in particular, to issuers and distributors of prepaid, debit, credit, and service cards, traveler cheques issued by entities other than financial entities, as well as cryptocurrency exchanges. There is minimal case law issued with respect to payment systems laws and regulations, however, there are important judicial precedents to take into consideration by any participant in a card system, including precedents regarding authenticity and use of electronic signatures, vouchers, and burden of proof with respect to authorisation of transactions.

Yes, payment services in Mexico can be provided by non-banks. The regulation and required licensing applicable to payment services providers (“PSPs”) may vary depending on the type of services offered by them. In card payment acceptance services, acquirer and aggregation services do not require an ad hoc authorisation or license. Nevertheless, they are subject to the reporting and registration obligations set forth in the Payment Regulations, which include, among others, registering their fees with Banxico and CNBV and delivering a yearly informative notice to CNBV. Additionally, any person providing services to acquirers, aggregators, brand owners or issuers are catalogued as specialized entities under the Payment Regulations. Specialized entities do not require a license or authorisation to operate. However, they are subject to specific obligations under the Payment Regulations including certain reporting obligations. Certain activities that are usually performed by PSPs may qualify as regulated activities that require a license, registry or authorisation under Mexican law, including (i) solicitation and receipt of deposits, and depository account keeping services, (ii) money remittance services, and (iii) currency exchange services. PSPs, especially those operating on a cross-border basis, should be cautious while structuring their operations to avoid falling unintentionally under the purview of regulated entities.

According to a Deloitte research, the most popular payment methods in Mexico are cash, debit cards, credit cards, and digital payments. Although there is a significant increase in the use of electronic payments in Mexico, cash remains to be the most widely used payment method in Mexico for retail transactions. At lower rates, P2P platforms such as PayPal, Mercado Pago and Swap are being increasingly used in the country. Also, the mobile payment system launched by Banxico, CoDi (Cobro Digital), has been enabled by 86 entities, most of them in the financial sector. From the B2B perspective, acquirers and aggregators have a clear underlying tendency with millions of micro and small businesses that have adopted payment facilitator solutions.

Mexico is a pioneer not only in open banking but also in open finance. The Fintech Law promotes competition and financial inclusion by requiring Mexican financial entities (including commercial banks), money remittance entities, credit information entities, clearing houses, IFPEs and companies authorised to operate with regulatory sandboxes (modelos novedosos) (“Authorised Entities”), to implement application programming interfaces (“APIs”), and to share information of their customers through such APIs. APIs and the sharing of information must meet the requirements issued by the CNBV, Banxico or the corresponding regulators of the relevant entities. The information to be shared through APIs is classified under the Fintech Law as: (i) open data, including, among others, non-confidential financial information related to the services offered by the entities; (ii) aggregated data, consisting on statistics and information related to transactions made by or through Authorised Entities; and (iii) transactional data, defined as information related to the use of financial products and services by a customer, including deposit accounts and credits. Transferring transactional data of customers requires express consent from the respective owner in all cases. On June 4, 2020, the CNBV issued the Regulations applicable to APIs (Disposiciones de carácter general relativas a las interfaces de programación de aplicaciones informáticas estandarizadas a que hace referencia la Ley para Regular las Instituciones de Tecnología Financiera). The regulations are applicable to the Authorised Entities (financial entities, IFPEs, money remittance entities and companies authorised to operate with novel models) but only regulates the treatment of open data. The regulation applicable to aggregated and transactional data is still pending. Similarly, Banxico published Rule (Circular) 2/2020 which is applicable to credit rating agencies and clearing houses. The Circular establishes, among other things, requirements to obtain authorisation from Banxico to set up the relevant APIs. Each of the Banxico regulated entities shall describe the aggregated data per type of transaction that is intended to be shared through the API. Also, the entities accessing the information should be previously authorised by Banxico for such purposes. Participants of the Mexican fintech industry are expecting the pending regulation, given that the access to such data will enable them to develop and offer new and innovative financial products and services. Regulation of aggregated data and transactional data is expected to be issued within the next twelve months.

As a result of the implementation and continuous growth of open banking services in Mexico, in early 2022 the Mexican regulator authorized the first fintech entity engaged in the open-banking sector. Belvo, an electronic payment funds institution, provides open banking services that allow users to share their banking information with third parties through APIs. To do so, such entity collects its clients’ consent in compliance with the privacy and security requirements set forth in the applicable Mexican regulation. Also, other large competitors such as Rappi and Mercado Libre have expressed interest in providing open banking services.

We consider that open-banking and open-finance models will become one of the main allies for financial institutions, benefiting end-customers, by offering tailored products and services, faster access to credit and financing, data security, and transparency. Additionally, the implementation of open-banking services will remain crucial to reduce the information concentration risk derived from a high concentration of the market by large Mexican financial institutions, increasing competition in the sector and, ultimately, benefiting end-customers.

Mexico has a robust set of laws and regulations governing data privacy, including the Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares) and its secondary regulation (jointly, the “Data Protection Laws”). Data Protection Laws are applicable to entities (other than credit information entities) that receive and process information of individuals in Mexico, and establishes the principles, requirements and obligations for any individual or entity to treat, use, disclose and transfer such personal data. The main obligation for a data controller is to deliver a privacy notice to the data owner and obtaining its consent to treat the information in accordance with the privacy notice. Data controllers must also appoint a data protection officer, as well as adopt and maintain security measures with respect to personal data, to a standard at least equivalent to those adopted for their own information. In addition, banks, IFPEs and other depository institutions, as well as broker dealers and other financial entities are subject to the relevant secrecy provisions set forth in their corresponding applicable laws and regulations. Acquirers, aggregators, and issuers in a card network are also subject to the security standards set forth in the Payment Regulation, which include obligations to implement certain security measures, encrypt personal information of the cardholder, control access to data bases.

The Fintech Law is based on principles of innovation and inclusion, and the policy of Mexican financial authorities is to further those principles through regulation. Considering the foregoing and acknowledging the ever-changing nature of the fintech industry, the Fintech Law introduced the regulatory framework applicable to sandboxes. The sandbox authorization provided in the Fintech Law enables nonfinancial entities to temporarily offer financial services by means of a regulatory sandbox (using tools or technological means differing from those existing in the market), which would otherwise require a license or authorisation pursuant to Mexican financial laws. Additionally, the Fintech Law allows CNBV and Banxico to grant a sandbox authorisation to financial entities to temporarily operate novel models with activities that are restricted by the laws and regulations governing them. Banxico has been particularly active in promoting innovation mainly to encourage financial inclusion. Also, CNBV has actively partaken in the “Sandbox Challenge” open competition to incentivize innovation and has traditionally taken an open stance towards innovation and use of technology by applicants and financial entities. We note that the National Commission for the Pension System (Comisión Nacional de Servicios de Ahorro para el Retiro) as well as the National Insurance and Bond Commission (Comisión Nacional de Seguros y Fianzas) have issued regulations based on the Fintech Law setting forth the requirements and procedures to obtain an authorisation to operate novel models to offer products or services that are otherwise restricted to entities authorised by such regulators.

According to the Mexican Fintech Annual Report for 2023, regulation, technology, human and financial resources as well as competition are considered the main challenges by fintech entrepreneurs. Also, according to Finnovista’s report for 2023, 66% of fintechs identified scaling operations and international expansion as their main challenge, 39% identified access to financing, 35% identified launching a service or product as well as attracting and retaining talent, and 10% identified cybersecurity and technological infrastructure. We also note that the extensive use of cash (see answer 3) continues to be a challenge for the fintech market; tackling such challenge will require a coordinated effort by the government and market participants to convey trust and reliability to users.

There are no specific tax incentives encouraging investment in fintech in Mexico.

Payment services, consumer lending and enterprise technologies for financial institutions represent approximately 60% of the new companies in the sector. These are also the sub-segments that are attracting the most investments into Mexico SoFi, Goldman Sachs, Softbank, Dalus Capital, Ignia Partners and IFC are among the various international investors that have invested in Mexican fintech startups, particularly in Series A and B rounds of such entities. The credit defaults of certain pay-day loan, individual loans and lease companies has depleted a substantial portion of their market value, thereby signalling investors to take a more conservative approach to the lending and leasing sector. Investments through strategic partnerships between banks and startups are also present in the market and will continue to develop in the future once open banking regulations are issued. We have also seen significant investment in terms of research and development in connection with cryptocurrencies, blockchain based systems, proptech, insurtech and crowdfunding. Payments and remittances services represent the strongest sub-segments for investment and development.

Mexico has been one of the pioneer countries to enact a fintech legal framework, becoming a watershed in the LATAM region. As a result, Mexico has implemented a thriving fintech ecosystem founded in users that are increasingly technology savvy, communicated and are willing to migrate to a technology based economy, as well with regulators focused on the user and allowing participation in the market. The depth of the market explains the very low failure rate of entities in Mexico. The number of fintech startups continues to rise steadily. According to a study by the Visa Innovation Center, Mexico is considered the leader in business innovation in Latin America and provides entrepreneurs with a solid regulatory framework giving legal certainty to innovate and develop disruptive projects. According to J.P. Morgan, Mexico’s e-commerce market is valued at US$38.9 billion, and according to the World Bank and McKinsey, more than half of Mexican small-and medium sized companies have no access to financial services, traditional financial services providers, such as banks, have not been able to fully overcome this issue, despite their efforts and resources invested. Fintech entities are becoming a major change factor in these regards and are proving to be a substantial part of the solution that is likely to change the financial social culture in Mexico. Mexico continues to be an investment friendly jurisdiction with an exceptionally large number of free trade agreements, investment protection and treaties to avoid double taxation. The Mexican legal mainframe for private equity transactions is sound and well established, and the regulation on fintech is designed to allow private and public investments in the sector. Also, only 7% of fintechs in Mexico are crowdfunding and electronic payment funds institutions, while the rest operate under a different spectrum of the law leaving a broad flexibility for investors to find the most adequate business model or financial structure to best fit their needs.

Foreign employees in Mexico are allowed to work in Mexico provided they obtain a temporary working visa or a visiting visa to carry out remunerated activities. To obtain any of such visas the employer must file an application with the National Immigration Institute (Instituto Nacional de Migración) requesting the visa based on a job offer. There is no current or pending regulation that may facilitate access to talent for fintechs. We do not expect to see in the near future any change in immigration regulation affecting particularly access to fintech talent given that the industry has very little influence on immigration policies.

Financial entities, fintech associations and universities are the main promoters of talent for the fintech industry in Mexico. The contribution of the regulator in the promotion of talent is more visible in the controlling side of the business, where internal comptrollers must be certified by the regulator. Nonetheless, we do not see substantial gaps in access to talent. The Mexican fintech industry is covered either by local talent or by foreign talent under the current standard immigration regulation; in fact during recent years, we are seeing an increase in young talent seeking to be part of the largest Mexican fintech entities.

The Copyright Law (Ley Federal del Derecho de Autor) provides express protection to computer programs. Such protection covers application softwares and operating systems in both, source code and object code. Other type of developments such as databases may also be subject to protection under the Copyright Law, as long as they are deemed intellectual creations based on the selection and layout of data or information. The use, reproduction or profit obtained from a copyright work without the previous consent of the copyright owner would be a breach to the Copyright Law. The copyright owner may claim for compensation before the Industrial Property Mexican Institute (“IMPI”) who may declare injunctions or impose fines. The Industrial Property Protection Law (Ley Federal de la Protección a la Propiedad Industrial) provides useful protections for Fintechs, for example regarding trade secrets and trademarks. For a trade secret to be protected, it must mean a commercial advantage and it must be kept confidential. In the event of misappropriation by a third party, the owner of the trade secret may initiate actions and claim compensation for unfair competition. Regarding trademarks, fintech providers must register their brands with the IMPI to obtain the exclusivity right to use their brand within Mexican territory. On July 1, 2020, the United States-Mexico-Canada Agreement (USMCA) entered into force (replacing the 1994 North America Free Trade Agreement). The new USMCA (known as T-MEC in Mexico) increases the standards for intellectual property protection in Mexico. The USMCA establishes a number of requirements to be met by the three signatory countries to improve protection to intellectual rights. Among them, the USMCA requires the parties to enact regulation for tougher sanctions and effective actions against infringement of intellectual property.

The Fintech Law, its secondary regulation including Rule (Circular) 4/2019 issued by Banxico, and the AML Law, establish the regulatory framework for cryptocurrencies, which are defined therein as virtual assets. Each virtual asset should be carefully analysed to determine its legal attributes, especially in view of any tokens associated therewith. The classification and legal treatment of a virtual asset may vary drastically depending on the characteristics of the virtual asset and its corresponding token, and such characteristics may determine the rules applicable to the offering, distribution, custody and even taxation of such virtual assets and any transactions involving them. That being said, a large number of virtual assets may be characterized, as a rule of thumb, as movable intangible and fungible properties for Mexican law purposes. Virtual assets are not considered national or foreign fiat currency even if they are stable coins. Notwithstanding the above, virtual assets referred to national or foreign fiat currency are not considered as such under Mexican law (stablecoins).

The Fintech Law grants ample regulatory authority to Banxico with respect to virtual assets. Banxico has adopted a very cautious position regarding the distribution of virtual assets in Mexico, because, among others Banxico perceives that the public may not have sufficient information to adequately understand the complexities associated with a virtual asset. Regulators have also stated their concern in terms of cybersecurity risks, which have been one of the mayor topics discussed by international regulators, since technological vulnerabilities, including cyber-attacks and cyber-frauds to cryptocurrencies exchanges and platforms have been increasing in recent years.

As a result of the above, Banxico has opted to put some “safe distance” between virtual assets (and their perceived risks) and the Mexican public. The Fintech Law provides that IFPEs may keep virtual asset denominated accounts for their clients, and that banks may carry out transactions with respect to cryptocurrencies, in both cases, solely with respect to cryptocurrencies approved by Banxico. However, Rule (Circular) 4/2019 issued by Banxico restricts the use of virtual assets by Fintechs and banks to “internal operations” (i.e., operational transactions whereby any risks stemming from the virtual assets are assumed by the entity), and solely with respect to virtual assets that are approved to each entity after a thorough authorisation procedure that includes practically every aspect of the virtual asset, its characteristics, operation and market, as well as a clear identification of the “internal operation”. In addition to the foregoing, Banxico has amended regulations governing SPEI to increase the KYC/AML requirements of depositary institutions with respect to their clients engaged in the transfer of virtual assets. Additionally, any Mexican entity offering virtual asset exchange or custody services in Mexico is subject to the compliance requirements set forth in the AML Law (among others, keeping KYC files and meeting certain reporting requirements).

Initial coin offerings (“ICOs”) are not specifically regulated in Mexico. Currently, the authorisations to operate cryptocurrencies do not contemplate ICOs, but only exchange, transfer and custody of cryptocurrency. We do not expect specific regulation on ICOs to be issued within the next few years.

There are certain blockchain-based products designed and operated by foreign payment processors that operate in Mexico today and that simplify the operation of multiple accounts for international remittances. An example of a live blockchain project in Mexico is Prescrypto. This product enables medical doctors to issue, sign, track and record digital prescriptions keeping sensitive clinical data safe using blockchain technology. The blockchain technology prevents prescription frauds and makes more efficient the provision of health services mor efficient.

The Deputy Finance Minister explained that Mexico recently joined the global initiative “Collective engagement to implement crypto -asset reporting framework” to address tax evasion and ensure its compliance. In the private sector, Mi primer Bitcoin (a company from El Salvador) launched the first Bitcoin course at a public middle school in Mexico.

Finally, many organizations like the Mexican Blockchain Network and LACChain have facilitated task forces and technological infrastructure to empower the Blockchain sector.

The use of artificial intelligence (“AI”) has become more frequent in the last year. AI companies such as Open AI (ChatGPT) and Google (Google Cloud), which will launch a regional cloud in Queretaro and estimates that investment in further digitalization of the Mexican economy could drive 15% growth in gross domestic product (product interno bruto) by 2030, see great potential in the country.

Several banks and other financial entities have implemented artificial intelligence in their internal (operative) tasks, including customer service. There are artificial intelligence tools to deliver “roboadvisory” and “chatbots” services for asset managers, and treasury services. Unfortunately, the regulations applicable to sharing transactional and aggregated data are still pending, which are crucial to encourage open banking and artificial intelligence to be applied in connection therewith.

The UNESCO and the National Alliance for Artificial Intelligence (Alianza Nacional de Inteligencia Artificial) have announced their collaboration to prepare a diagnosis of the state of this technology in the country through which the Mexican Congress intends to obtain insights for eventual regulation and promotion.

In our view, the regulatory approach towards the use of artificial intelligence by financial entities will continue to promote the use of artificial intelligence in the financial sector increasing the responsibilities of chief information officers and holding financial services and operations (whether automated or not) to the same standards.

Insurtech must be understood as the use of new technology to improve the quality and increase business opportunities at various value-added phases in the insurance industry. Insurtech projects have increased significantly in several areas of the insurance industry in Mexico such as distribution, underwriting, valuation, prevention, claims handling, risk distribution, among others. According to an article from El Economista, Mexico is considered the country with the second largest number of insurance technology companies in the region.

Companies in the top ranks of revenue and employees belong mainly to the digital banking, lending and payments, and remittances sectors. Given the continuous growth and transition to electronic payment means, most of the entities that initially applied for a fintech license, were the ones specialized in such area, thus during the last months, most of the authorizations granted by the Mexican regulator have been specifically for electronic payment funds institutions.

From a high-level perspective, Fintechs are disruptive in the Mexican market as they have gained a significant penetration in the payments market, which continues to be dominated by the seven largest commercial banks. Commercial banks and other depositary institutions (including popular financial entities similar to thrifts) have generally welcomed the collaboration with Fintechs, especially IFPEs, and have been opting to join the BaaS (banking as a service) field, offering their APIs to third parties so, especially startups, can create new financial products without having to be part of the traditional banking sector, which also benefits the financial sector and enables financial inclusion.

Certain depositary institutions have partnerships with Fintechs, whereby Fintechs design and offer new payment products and depositary institutions take care of the account keeping and compliance part of the business. These alliances have resulted in an accelerated time-to-market for a number of products. We also expect that bigger Fintechs will eventually have the intention of migrating their business model into a bank or thrift. It is to be expected that as the Fintechs grow stronger and claim their legitimate place in the (still) bank dominated payments market, bigger players will be vigilant for investment, co-investment and acquisition opportunities. In the following years, we may see an increased M&A activity in the sector. Crowdfunds have been regulated as microfinance entities and although they have had good penetration in the market, we would expect to see a strong  growth in the use of crowdfunds by the public (both as an investment opportunity and as a funding alternative) in the years to come, as there is an enormous potential market for their services, and they may easily coexist with other well established microfinance products (such as pay day loans, and pawn shops).

The vast majority of banks and other financial institutions have internalized fintech R&D and are active in developing their own innovation programs and solutions. Some of the biggest commercial banks invest heavily in fintech tools, and banks affiliated with foreign financial institutions take advantage of the fintech developments of their (most times, larger and more invested) parent companies. For example, in recent years, several Mexican banks have been partnering with digital banking services providers, such as Getxerpa who helps financial institutions implement technology via cloud-hosted APIs, helping traditional banks to set up financial health and customer tracking tools, which has been already implemented by both traditional financial institutions such as Santander, and entities such as Nubank, Stori and Albo.

Incumbent financial institutions will continue to carry their own R&D in fintech tools while keeping a close proximity with the new developments launched in Mexico.

At this point in time, disruption has been more about how financial services are delivered more than about how much have such disruptive agents penetrated the market. We see strong disruption in (i) payday and personal lending, (iii) targeted, simpler and customer friendly payment products, (ii) how cryptocurrencies are being introduced in Mexico for investors and financial entities (including remittance companies), (iv) distribution of personal investment products, (v) open-banking services; and (vi) more available funding in crowdfunds. We are also aware of a number of projects that will be deployed shortly and may have a disruptive effect by offering a more comprehensive scope of electronically delivered services to the end user. We see how developers and data processors strive to deliver better solutions to meet security requirements, increase levels of service and offer more efficient and reliable IT services. With the recent increase of fintech authorizations, we are likely to see significant examples of disruption through fintech in Mexico as novel models.