The principal Mexican authorities for banking regulation, supervision and resolution are the following:

• The Ministry of Finance and Public Credit (Secretaría de Hacienda y Crédito Público) (the “SHCP”), which is responsible for designing and conducting the policies of the Federal Government of Mexico with respect to the financial system in general. The SHCP, through its Financial Intelligence Unit (Unidad de Inteligencia Financiera), is in charge of regulating banks and other financial entities in connection with anti-money laundering matters (although compliance with these regulations is within the scope of authority of the National Banking and Securities Commission (Comisión Nacional Bancaria y de Valores) (the “CNBV”), while the Banking, Securities and Savings Unit (Unidad de Banca Valores y Ahorro), is in charge of regulating, supervising and evaluating banking regulatory, corporate and financial matters;
• The Central Bank of Mexico (Banco de México) (the “Central Bank”), which is in charge, among others, of promoting the proper functioning of the financial and payment systems;
• The CNBV, which is in charge of regulating, inspecting and overseeing banks, among other financial institutions;
• The National Commission for the Protection and Defense of Financial Services Users (Comisión Nacional para la Protección y Defensa de los Usuarios de Servicios Financieros), which is in charge of the protection and defense of users of the services provided by financial institutions, including banks; and
• The Bank Savings Protection Institute (Instituto para la Protección al Ahorro Bancario) (“IPAB”), which manages a deposit insurance available to account holders in case a bank becomes insolvent, and oversees and manages the failure or liquidation of banks.

The requirement of a banking license is triggered by the provision of “banking and credit services” which are defined as the raising of funds or deposit-taking activities from the public in the national market for their placement among the public, through acts that cause a direct or contingent liability where the intermediary is required to repay the principal and, if applicable, any financial return.

Please note that the mere lending activity does not trigger the requirement of a banking license.

Banks can undertake all of the activities described in the Mexican Banking Law (Ley de Instituciones de Crédito) without needing different banking licenses. However, a bank may elect to perform a limited number of activities, or the full range of activities permitted to banks, which shall be reflected in the authorization received from the CNBV.

Depending on the type and number of permitted activities they perform, banks will be subject to differentiated capitalization requirements. E.g., a bank conducting all the operations permitted in the law needs to have a minimum capitalization of ~USD 37 million. Meanwhile, banks who only perform a limited number of permitted activities require a minimum capital of ~USD 22 million.

Please note that there are other financial entities authorized for deposit-taking activities (e.g., sociedades financieras populares), which have specific non-banking licenses, and are subject to their specific regulation and capitalization requirements.

A bank’s license granted by the CNBV specifies the activities that the bank may conduct, pursuant to a list of permitted activities set out by the Mexican Banking Law, all of which are related to banking and credit services. Payment services are considered among these type of services. However, a banking license does not permit banks to operate –let alone automatically– as a broker-dealer, to issue e-money, or to conduct other activities that are reserved to other types of financial entities and subject to their particular regulation (e.g., insurance).

For example, the Mexican Fintech Law provides that the issuance to the public of e-money (fondos de pago electrónico) will be reserved to E-money Issuers (“IFPE”), which activities are subject to a license granted by an inter-institutional committee formed by the CNBV, the SHCP and the Central Bank.

The Mexican Fintech Law does provide a sandbox, whereby banks, other financial entities, or even non-financial entities in certain instances, may be authorized by the CNBV, the Central Bank, or the SHCP, according to their respective authorities, to conduct operations or activities on a temporary basis related to their permitted corporate purpose, through technological devices or tools different from those already existing in the market (Modelos Novedosos).

The temporary authorization must indicate the exceptions, terms, and conditions related to the products to be offered. Said authorization remains valid only for a year (in the case of financial entities) or two years (in the case of non-financial entities), and may be extended for only another year.

As of the date of this chapter, the Mexican regulators have not granted any authorizations under the sandbox legal framework.

The Mexican Fintech Law provides that financial institutions, including banks, may operate with crypto currencies as determined by the Central Bank through general regulations, and provided that they obtain the authorization from such entity. However, the Central Bank –through secondary regulations- disallowed banks from engaging with their clients in any transaction involving the exchange, transmission or custody of crypto currencies. Banks may operate with crypto only for “internal transactions” and provided they obtain the prior authorization from the Central Bank.

Crypto assets do not qualify as deposits and, therefore, they are not covered by deposit insurance.

Furthermore, Mexican regulators have stated that the issuance of “Stablecoins” –considered as units of monetary value stored digitally in distributed ledger technologies, that generate collection rights against the issuer and are issued against the receipt of funds in fiat, with the purpose of carrying out payment transactions with persons other than the issuer- is not different from deposit-taking activities, which may only be carried out by Mexican financial entities authorized to engage in said activities (e.g. banks or SOFIPOs).

As of March 2025, there are no specific capital requirements in connection with crypto assets held by Mexican banks.

However, it is important to consider the following:

1. Operations by Mexican banks with crypto assets have to be approved by the country’s Central Bank and, as such, banks have to identify the risks they run when operating with crypto assets. In this regard, banks must identify credit, market, or operational risks in connection with their holdings of crypto and adopt policies for an adequate management of such risks.
2. Crypto assets holdings are reflected in the banks’ balance sheets, and income statements, and must be marked-to-market pursuant to specific guidelines contained in the regulation. Banks must disclose in their financial statements market and liquidity risks associated with the holding of crypto assets.

The publication in December 2022 of the standard titled Prudential treatment of cryptoasset exposures (https://www.bis.org/bcbs/publ/d545.pdf), by the Basel Committee on Banking Supervision of the Bank for International Settlements is likely to influence Mexican regulation in the near future.

Figure 1. Synthesized general application process for bank licenses

The bank-licensing timing may vary depending on the complexity of the business proposed to the authority. In any case, once the bank-license is obtained, the bank must file its bylaws with the CNBV (within 90 days) for the authority’s approval and, thereafter, the bank must obtain the authorization from the CNBV to start its operations, within no more than 180 days.

No, mere cross-border activity is not permissible, since banking and credit services in Mexico may only be provided by licensed Mexican banks. However, as a general rule, Mexican residents are not prohibited from engaging financial services from foreign financial entities, provided those are not conducted within Mexican territory.

Care should be taken in the manner in which such foreign financial entities conduct these cross-border activities, to ensure that they do not conduct any activity that could be subject to sanctions by Mexican financial regulators.

Only limited liability stock corporations (sociedades anónimas) with fixed capital, incorporated pursuant to the laws of Mexico and having an authorization granted by the CNBV can be organized and operate as banks.

Banks shall be incorporated as sociedades anónimas with at least 2 shareholders with the minimum equity capital requirement applicable depending on the activities included in its by-laws.

The board of directors and the CEO will be in charge of the management of the bank.

5-15 statutory members shall integrate the board of directors. At least 25% of them must be independent – based on the independence requirements set forth in the Banking Law – and only one third of the board members can be officers of the bank, as long as they are either the CEO or officers within the two lower levels from the latter.

A bank must have at least the following auxiliary committees to the board of directors:

• audit committee;
• risk committee;
• compensations committee;
• communication and control committee; and
• related-party transactions

Additionally, a Comisario – which is an external individual – shall be in charge of overseeing the performance of the board of directors in connection with the internal control system.

All directors of a bank must have technical capabilities, honorability, satisfactory business and credit history and ample financial, legal or administrative knowledge, and a majority must be Mexican-residents, while officers of a bank, including the CEO and all officers within the two hierarchy levels below the CEO, must be Mexican-residents with evidence of at least 5 years of previous professional experience in positions of high decision-making.

Banks are required to have a remuneration system that considers all remuneration, whether in cash or otherwise, and shall be consistent with effective risk management. The remuneration system must be flexible enough to allow the bank to reduce or suspend the payment of extraordinary remunerations whenever the bank faces losses or whenever the risk impacts are greater than expected.

If a bank does not comply with minimum capital requirements, the CNBV may impose corrective measures including the suspension of bonuses to senior management and distribution of dividends.

Yes, Mexico has implemented the Basel III framework. According to the Regulatory Consistency Assessment Programme (RCAP), the latest issued by the Basel Committee on Banking Supervision, in March 2015, which is the most recently available compliance report, Mexico was found “…compliant with the minimum Basel capital standards”.

12 out of 15 criteria were found to be compliant, two largely compliant (regarding capital buffers and disclosure requirements), and one of them was not applicable (the internal models approach to determine market risk capital requirements), although Mexico has further continued its implementation of Basel III.

Yes, in Mexico as a general rule the leverage ratio must be more than 3%.

Banks shall calculate such ratio with information at the closing of every month, without consolidating its subsidiaries or special purpose vehicles, taking into account their operations in Mexico, as well as those of their overseas branches. However, the CNBV may determine that a given bank shall estimates such leverage ratio with more frequency, and said authority may also verify the calculations made by banks and instruct to perform adjustments.

As discussed above, Mexico has implemented the Basel III liquidity requirements, including the Liquidity Coverage Ratio (“LCR”) and the Net Stable Funding Ratio (“NSFR”). According to the Regulatory Consistency Assessment Programme (RCAP) issued by the Basel Committee on Banking Supervision in March 2015 “…the final LCR requirements in Mexico are assessed as compliant with the minimum Basel liquidity standards”.

Yes, banks must publish their financial statements on an annual basis. These are filed within the first three months of the subsequent year.

Banks are also required to publish their interim reports with information as of March, June, and September of each year.

Consolidated supervision, namely the “…comprehensive approach to banking supervision which endeavors to evaluate the strength of an entire group, taking into account all the risks which may affect a bank”, does exist in Mexico, particularly in connection with financial groups.

Under Mexican law, a corporate group comprised of two or more financial entities can be organized in the form of a financial group (grupo financiero). Financial groups in Mexico must be comprised by a controlling holding entity, and no less than two financial institutions. For regulatory purposes, the controlling entity and the financial institutions will be considered one single economic unit regarding information revelation, accounting, among others.

Financial groups are subject to the supervision of the financial authorities. Particularly: (i) the controlling entity will be subject to the supervision of the SHCP, (ii) each financial entity part of the financial group will be subject to the supervision of the relevant surveillance commission (in the case of banks, the CNBV); and (iii) the financial group as a whole will be supervised by one of the financial regulators, depending on the type of financial entities that comprise the financial group. Typically, if the financial group includes a bank, the surveillance authority of the financial group as a whole will be the CNBV.

Consolidated supervision, namely the “…comprehensive approach to banking supervision which endeavors to evaluate the strength of an entire group, taking into account all the risks which may affect a bank”, does exist in Mexico, particularly in connection with financial groups.

Under Mexican law, a corporate group comprised of two or more financial entities can be organized in the form of a financial group (grupo financiero). Financial groups in Mexico must be comprised by a controlling holding entity, and no less than two financial institutions. For regulatory purposes, the controlling entity and the financial institutions will be considered one single economic unit regarding information revelation, accounting, among others.

Financial groups are subject to the supervision of the financial authorities. Particularly: (i) the controlling entity will be subject to the supervision of the SHCP, (ii) each financial entity part of the financial group will be subject to the supervision of the relevant surveillance commission (in the case of banks, the CNBV); and (iii) the financial group as a whole will be supervised by one of the financial regulators, depending on the type of financial entities that comprise the financial group. Typically, if the financial group includes a bank, the surveillance authority of the financial group as a whole will be the CNBV.

The acquisition and transfer of the shares of a bank are subject to the following requirements:

• Acquisition or sales of less than 2% of the common shares do not trigger any regulatory requirement;
• Acquisition of transfer of 2%-5% of the common shares require both parties to give notice to the CNBV within three business days of completing the transfer;
• Direct or indirect acquisition of (or the creation of collateral over) 5%-20% of the common shares require the prior authorization from the CNBV, which shall take into consideration the opinion of the Central Bank; and
• Direct or indirect acquisition of 20% or more of the common shares or the acquisition of control of a bank requires prior authorization from the CNBV, and the prior favorable opinion of the Central Bank.

Note that if the bank’s shares are publicly traded, additional requirements may apply pursuant to securities regulations. Merger control authorizations under Mexican antitrust laws may also be required.

Yes, the Mexican regulatory regime imposes conditions for eligible owners of banks. The persons aiming to acquire, either directly or indirectly, more than 5% of the shares of a bank, or to obtain the control of said financial entity, shall file an application for authorization with the CNBV.

This includes filling official forms indicating their personal information; the current participation that such person may have (if applicable) in the bank’s equity; the source of funds to purchase the bank’s stock; filing of tax returns; professional information of the applicable person; as well as representations on that person’s character and fitness requirements to acquire the shares.

These requirements apply both to direct and indirect shareholders that meet the applicable thresholds under the regulation.

There are no restrictions for foreign private investment in banks. Foreign governments are only allowed to participate (directly or indirectly) in the capital of private banks in Mexico if (i) the investment is made pursuant to temporary financial relief programs; (ii) the participation is indirect with no controlling interest; and (iii) the acquisition involves an indirect shareholding interest that will not result in control. If the bank is organized under the “foreign financial entity affiliate” regime, particular corporate requirements would apply.

There is a special regime for domestic systemically important banks. Every year, the CNBV assesses the banks operating in Mexico to determine whether they should be considered as domestic systemically important banks. The qualification as such, as well as the loss of a systemically important bank characterization, must be notified by the CNBV to the applicable bank.

The systemic importance of banks in Mexico is assessed through a methodology estimating the size of the bank relative to the whole system, its interconnectedness, the complexity of its operations, and the importance of the services it provides to the economy.

Such banks are required to comply with additional capital requirements proportionate to their credit, market, and operation risks.

Depending on the type of violation, sanctions can range between the following:

1. Admonitions;
2. Fines;
3. The suspension, removal or disqualification for persons to undertake banking operations and services, or to occupy positions in legal entities operating in the financial
   sector,
4. The revocation of licenses or authorizations to operate in the banking sector; and
5. Prison for up to 15 years.

The Mexican Banking Law sets forth a number of cases in which a bank resolution process may be initiated. “Bank resolution” is deemed to be either a liquidation process in order to extinguish such bank or, in exceptional cases (because of the systemic importance or relevance of the bank) a series of alternative procedures to financially rehabilitate the institution.

The type of bank resolution technique depends on the determination by the Banking Stability Committee (which is formed by high-ranking officers from the SHCP, the Central Bank, CNBV and IPAB) on whether a bank is systemically important and what percentage of the bank’s non-IPAB-insured liabilities are susceptible to systemic repercussions. Systemically important banks would be subject to bank restructuring (saneamiento) (which includes payment of liabilities or purchase-and-assumption techniques). Non-systemically important banks would be subject to a winding-up process and liquidation.

Restructures can be through equity capital provided by the IPAB, provided that the bank applied for a conditioned operation regime, or through loans granted by the IPAB if the bank did not. When the IPAB makes equity contributions, it will initiate the sale of the bank’s shares. If the IPAB provides a loan to the relevant bank, all of the shares issued by the bank will secure the loan until the shareholders of the bank subscribe and pay a capital increase to pay for said loan. If the shareholders do not make this contribution, the IPAB will automatically acquire the shares and will sell them thereafter.

If the bank is subject to a purchase-and-assumption transaction, all of its assets and liabilities will be transferred to another commercial bank by either the incorporation of a “bridge bank” (a financial institution incorporated ad hoc and operated by IPAB for the compliance of the bank’s obligations and the transfer of such assets and liabilities) and/or the direct transfer of such assets and liabilities to another commercial bank.

In the event of liquidation, the IPAB will act as the liquidator of the bank and will generally be responsible for terminating and concluding all pending business of the bank, including the settling of accounts and the disposition of assets.

The IPAB is in charge of providing a guaranty to bank liabilities, including demand and term deposits, savings accounts and revolving deposits associated with debit accounts, through the savings protection fund. Liabilities are guaranteed up to the amount of 400,000 inflation-adjusted units (UDIs) per person per bank (approximately USD 161,000).

The deposit insurance will be paid upon determination of the resolution of a bank and any amount not paid by the IPAB can be claimed directly by the depositor from the relevant bank.

Yes. In June 2021 (and effective as of March 1, 2022), the CNBV issued regulations establishing the Total Loss Absorption Capacity (“TLAC”) standard, which had been adopted by the Financial Stability Board, the purpose of which is to establish a portion of equity and bail-in subordinated debt of domestic systemically important banks that can be passed to investors, without the need of support from the government (bail-outs) or loans.

Instruments eligible for bail-in comprise no less than 6.5% of the total risk-weighted assets of the banks operating in Mexico (e.g. equity, among others), in addition to any other applicable regulatory capital requirements. This means that Mexican banks must have equity and subordinated debt that could absorb losses.

CNBV regulations establishing TLAC focus on managing credit, market, and operational risks (not liquidity risk) for domestic systemically important banks. Such rules also provide specific rules to determine the types of instruments that can be counted towards meeting TLAC requirements, such as certain instruments qualifying for AT1 capital, and shares or subordinated debentures complying with certain specific rules.

Yes. According to rules issued by the CNBV on June 18, 2021, domestic systemically important banks must have a Total Loss Absorbing Capacity (TLAC) equal to no less than 6.5% of their risk-weighted assets. The regime does differentiate between different types of banks, as the TLAC requirements only apply to domestic systemically important banks, as classified by the CNBV.

These requirements to supplement the net capital of the subject banks became effective in December 2022. Domestic systemically important banks will be required to comply with the totality of this new regulatory framework by December 2025.

Yes, there is a responsibility regime for managers of a bank who must comply with fit and proper requirements, including experience in the financial sector or other relevant management experience, being in compliance with their credit obligations, and not having been subject to certain criminal sanctions.

Board members shall also refrain from deliberating or voting in any manner that would represent a conflict of interest, as well as maintain confidentiality of all activities or information of the relevant bank where they act as board members, and of all deliberations conducted in board meetings. Board members that fail to comply with these obligations may be subject to monetary fines ranging from approx. US$55,600 to 278,000.

Additionally, board members, managers and employees of a Mexican bank may be criminally liable in the following cases, with knowledge that these activities will result in a damage to the bank:

1. Participate in the process to grant a loan knowing about the falsity of the information used by the loan’s applicant for such purposes;
2. Directly or indirectly alter or replace the information provided by a loan’s applicant to hide the reality about assets or liabilities;
3. Grant loans to entities created to get bank financing, knowing that such entities do not have the equity states in their articles;
4. Grant loans to insolvent persons in order to release a debtor from liability, tampering with the banks’ records on assets;
5. Give loans to persons about whom the managers or employees of the bank know they are insolvent, should it be predictable that those persons lack the economic capacity to pay for the loans, causing a damage to the bank;
6. Renewing expired loans, either totally or partially, to insolvent persons should it be predictable that those persons lack the economic capacity to pay for the loans, causing a damage to the bank;
7. Knowingly allowing a debtor to funnel the loan’s funds to his own benefit or that of third parties, resulting in a damage to the bank;
8. Conducting operations which have been expressly -but temporarily- forbidden by the Mexican Banking Commission for prudential reasons;
9. Unduly make, reproduce, import, print, transfer, market, alter, acquire, possess, holds, uses, or distributes payments instruments such as credit/debit cards, cheques, among others;
10. Obtain, transfer, or use the information about clients, bank accounts, or bank operations in contravention of the law;
11. Steal, alter, copy, or reproduce information or the authentication keys of the means of payment;
12. Hold, acquire, use, or transfer technology devices to copy or steal information of means of payment;
13. Hold, acquire, use, transfer, distribute, or promote the sale of means of payment knowing they are altered or falsified;
14. Unduly accessing or altering banking systems to get resources or information from the customers;
15. Tamper with the bank’s records;
16. File false data, information, or documents with the Mexican Banking Commission;
17. Lend knowing that the information to get the resources is false;
18. Destroy, or allow the destruction, either total or partial, of systems, records, or documents related to the accounting information of the bank before the applicable recordkeeping periods are exhausted;
19. Publish false information about the financial statements of the bank;
20. Unduly use, obtain, or transfer clients’ funds from banks;
21. Incite managers or employees of the bank to incur into criminal conduct;
22. Bribe public servants of the Mexican Banking Commission to do or omit their public functions;
23. Keep working within banks despite having been suspended, removed, or disqualified by the Mexican Banking Commission;
24. Conduct operations with related parties in excess of the provisions of the Mexican Banking Law, when they result in damages to the applicable bank, and
25. Unduly receiving benefits from the banks’ clients to conduct certain operations.

Regularly, for numbers “(ix)” to “(xv),” above, the applicable sanctions range from three to nine years in prison and a fine from ~USD 170,000 to ~USD 1’700,000. Nonetheless, when directors, managers, and employees of banks are involved in such criminal conducts, the criminal penalties will increase by half.

It is also important to note that banks are required to report, for AML/CFT purposes, suspicious transactions in which banks’ managers or employees are involved.

a) Due to the increase of technological developments in Mexico, the recent trends in bank regulation are mainly focused in the use of technology by Mexican banks, especially in connection with (i) electronic money, digital assets and other financial technology products; (ii) open banking; (iii) the enhancement of cybersecurity and AML controls  for digital banking; (iv) third-party risk management; (v) remote provision of services and execution of contracts, and (vi) digital agents.

As a result of the above, banks and regulators have focused their attention and resources to improve the management of operational risks derived from cyber-attacks and other potential technology risks.

Banks and regulators have also increased their focus on permitting remote means to identify clients and comply with know-your-customer rules taking advantage of technological developments.

b) Mexico held federal and local elections in 2024 which, among others, included the election of the Mexican President and of all members of the Federal Congress. As a result, the incumbent MORENA party won the Presidency, as well as a majority in both houses of  Congress and a majority of the states legislatures, resulting in the ability of the administration to pass constitutional and legislative reforms. As of March 2025, the banking sector has not been a major focus of the new administration.

c) Additionally, in January 2025 Donald Trump took office as the new President of the United States.

1. Some of the executive orders issued by President Trump include the designation of Mexican cartels as foreign terrorist organizations (FTOs). It is expected that these measures will result in the banks having to strengthen their internal controls to mitigate the risk of a potential association with these FTOs, and that these recent developments will make financial institutions to closely monitor how they deploy capital in Mexico.
   
2. Also, the determination whether or not to impose tariffs on all Mexican imports by the Trump administration may result in variations in the North American markets integration, which could derive in changes in how Mexican banks operate their business.
   
3. President Trump “…vowed to start the largest deportation effort in American history.” One of the multiple implications this could have is an increase of the demand for financial inclusion services by banks, in a context where they are, in turn, less prone to risk taking on the Anti-Money Laundering and Counter-Financing of Terrorism side due to the aforementioned designation of certain criminal organizations as FTOs by the U.S. Government.

This may lead to a stronger surveillance of the Mexican government on the banking activity, as well as to increase the demand of Mexican banks for  certain services (i.e. technology services).

There are various factors that could be categorized as impeding a full development of the financial sector in Mexico. Importantly, the lack of financial inclusion of a significant portion of the population is one of the most relevant adverse factors for the banking industry. While the Fintech industry has been buoyant in Mexico in the past few years, which has helped access to financial services to a large number of persons, there are still great challenges for banks to develop their full potential to foster the Mexican economy.

The increased interest of international players to enter the Mexican financial sectors and the growing participation of Fintech entities should continue to be instrumental in the following years to increase financial inclusion, particularly in low-income sectors and in small and medium businesses. The timing for enforcement of security interests should also be shortened to provide additional certainty lo lenders to increase the offer of lending products and decrease costs.

The development of a clear regulatory framework for the participation of technological companies in the financial services industry is also paramount for the strengthening of a more competitive financial sector in Mexico.

Additionally, the designation of Mexican cartels as FTOs as explained in our answer to question 28 could result in Mexican banks taking a more conservative approach in how they deploy capital and develop their business in Mexico, to mitigate potential risks under  this new regulatory environment. Mexican financial institutions (especially those controlled by foreign institutions) may take the approach to closely monitor how the U.S. administration enforces its authority over FTOs and private parties in Mexico, which could result in potential changes in how they conduct their business in Mexico.