Crypto Under the Fintech Law (ITF) in Mexico: Licensing, Requirements & Process

Mexico’s Ley para Regular las Instituciones de Tecnología Financiera, widely known as the Fintech Law or Ley Fintech (ITF), established Latin America’s first comprehensive framework for regulating virtual-asset activities when it came into force in March 2018. For any business seeking to operate a crypto exchange, offer digital-asset custody, or facilitate token-based transactions in Mexico, understanding crypto under the Fintech Law (ITF) is the essential starting point. The statute, together with secondary regulations issued by the Comisión Nacional Bancaria y de Valores (CNBV) and the Bank of Mexico (Banxico), creates a licensing regime that imposes prudential safeguards, anti-money-laundering (AML) controls, governance standards, and consumer-protection obligations on participants. This page provides a complete guide to eligibility, the step-by-step application process, timelines, costs, and ongoing compliance duties, giving founders, CFOs, and compliance leads the clarity they need before committing resources to the Mexican market.

Who Needs a Licence Under the Fintech Law (ITF)? Scope & Permitted Activities

The ITF establishes two primary categories of fintech institutions: Instituciones de Fondos de Pago Electrónico (electronic-payment-fund institutions) and Instituciones de Financiamiento Colectivo (crowdfunding institutions). Entities that operate with virtual assets defined by the law as representations of value electronically registered and used as a means of exchange fall under the broader regulatory perimeter supervised by the CNBV. Exchange platforms that match buy-and-sell orders in virtual assets, custodians holding private keys on behalf of clients, and brokerages facilitating token trading all require authorisation.

Borderline activities attract careful scrutiny. Non-custodial wallet providers and decentralised-protocol interfaces occupy a grey zone; however, any entity that at any point controls, holds, or transmits client funds or virtual assets will generally be treated as requiring licensing. The CNBV has adopted a substance-over-form approach, meaning that the economic reality of the service, not its marketing label, determines whether the ITF applies.

Cross-border considerations are critical. A foreign platform soliciting Mexican users, accepting Mexican pesos, or marketing services within Mexico risks triggering the licensing requirement even without a local office. In such cases, multiple authorisations from the CNBV, FATF-aligned AML obligations, and potentially Banxico currency controls may apply simultaneously.

Quick Overview: Is Your Business Eligible?

Before beginning a formal application, prospective applicants should confirm they meet the baseline eligibility criteria established by the ITF and its secondary rules:

• Entity type: Must be a Mexican-incorporated corporation (Sociedad Anónima or equivalent). Foreign companies must establish a local subsidiary or branch.
• Minimum capital: The CNBV prescribes minimum paid-in capital thresholds, which vary by the category of institution and the scope of permitted virtual-asset activities.
• Local presence: A physical office in Mexico and at least one locally resident director and compliance officer are required.
• AML/CFT programme: A fully documented anti-money-laundering programme must be in place before submission not after.
• Fit-and-proper management: All directors, significant shareholders, and key officers must pass background checks and demonstrate relevant competence and integrity.

Step-by-Step Process in Obtaining a Crypto Licence Under the Fintech Law (ITF) in Mexico

This section explains the standard steps to obtain authorisation under the ITF for virtual-asset activities in Mexico. While every application carries unique features, the regulatory pathway broadly follows these stages:

1. Preparatory Assessment: Activity Classification & Jurisdiction Fit

   Determine whether the planned business model falls within the ITF’s definition of a fintech institution operating with virtual assets. Map each product (exchange matching, custody, brokerage, token issuance) to the corresponding regulated activity. This step prevents costly mid-application reclassification and ensures you apply under the correct category. Engage with token classification analysis to confirm that the assets involved are not classified as securities under Mexican securities law, which would engage a separate regulatory track.

2. Corporate Structure & Local Presence

   Incorporate or restructure as a Mexican Sociedad Anónima. Foreign founders commonly establish a local subsidiary rather than a branch, as this simplifies capital segregation and governance. Secure registered office space, appoint at least one locally resident director, and open corporate bank accounts are prerequisites for demonstrating operational readiness to the CNBV.

3. Governance & Senior Management Appointments

   Appoint a chief compliance officer, a dedicated AML officer (Oficial de Cumplimiento), and a board that meets the CNBV’s fit-and-proper standards. Board members and significant shareholders (typically those holding 10 % or more) must submit detailed CVs, criminal-background certificates, and declarations of other business interests. The regulator reviews management competence and integrity as a gatekeeping condition.

4. AML/KYC Programme Design

   Develop a comprehensive AML/KYC framework that includes a risk assessment tailored to virtual-asset activities, customer due diligence procedures (including enhanced due diligence for high-risk categories), real-time transaction monitoring, and a suspicious-activity-reporting (SAR) process aligned with international standards for virtual-currency service providers. The programme must designate clear escalation channels and record-keeping timelines consistent with Mexican AML legislation (Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita).

5. Financial & Prudential Setup

   Deposit the minimum required capital, establish client-asset segregation mechanisms, and, where the regulator requires it, set up trust arrangements or dedicated custodial accounts. Mexico’s framework emphasises that client virtual assets must be ring-fenced from the institution’s proprietary holdings, a principle that echoes BIS prudential guidance on crypto-asset market structure.

6. Technical & Security Compliance

   Conduct independent security audits of the platform’s infrastructure. The CNBV expects evidence of penetration testing, cold-storage protocols for the majority of custodied assets, multi-signature key management, and disaster-recovery planning. Obtaining SOC 2 Type II certification or ISO 27001 accreditation, while not always statutory mandates, substantially strengthens the application and demonstrates commitment to operational resilience.

7. Application Package Assembly

   Compile the formal application dossier. This typically includes: completed CNBV application forms; a detailed business plan with three-year financial projections; the AML/KYC manual; technical-architecture documentation; proof of capitalisation; corporate-governance charter; and certificates of fitness for all key personnel. Incomplete packages are the single most common cause of processing delays.

8. Submission & Regulator Engagement

   File the application with the CNBV. Expect an initial completeness review lasting several weeks, followed by substantive analysis. Many applicants benefit from requesting a pre-application meeting with the regulator to clarify expectations and surface potential issues early. Formal Q&A cycles where the CNBV issues requerimientos de información (information requests) are standard and may iterate multiple times.

9. Remediation & Appeals

   If the regulator identifies deficiencies, weak AML controls, inadequate technology safeguards, or unclear corporate-governance structures, applicants receive a defined window to remediate. Persistent shortcomings can lead to formal refusal. In such cases, the ITF provides for administrative-review procedures, and applicants may escalate through Mexico’s federal administrative courts. Early remediation, guided by experienced counsel, is far more cost-effective than an appeal.

10. Post-Licensing Compliance Launch

    Upon receiving authorisation, the institution must immediately operationalise its compliance programme: activate transaction-monitoring systems, begin periodic reporting to the CNBV, submit to external audit schedules, and ensure consumer-protection disclosures are published. The CNBV conducts supervisory inspections both announced and unannounced from the first day of licensed operation.

Comparison Licensing Options & Alternatives in Mexico

Not every crypto-related business model demands a full ITF licence. The table below summarises the principal pathways and their trade-offs, helping founders choose the route that matches their product scope, risk appetite, and speed-to-market needs.

The ITF’s innovative-models (sandbox) regime the Modelo Novedoso allows startups to test crypto products in a controlled environment with temporary authorisation from the CNBV, but conversion to a full licence is required before scaling. Industry observers expect the CNBV to tighten criteria for sandbox entry as the market matures.

Key Requirements & Eligibility for Crypto Under the Fintech Law (ITF)

The CNBV’s assessment of licence applications revolves around several core pillars. Meeting each one is non-negotiable:

• Minimum capital: Applicants must demonstrate paid-in capital at or above thresholds published in the CNBV’s secondary regulations. Capital levels correlate with the scope and risk profile of the proposed activities.
• Fit-and-proper tests: Beneficial owners holding 10 % or more, board members, and senior officers undergo probity checks including criminal-background verification, credit checks, and declarations of conflicts of interest.
• Local establishment: A physical operating presence in Mexico, including a registered office and locally appointed directors, is mandatory.
• AML/CFT programme: As prescribed by FATF Recommendation 15 and the risk-based approach guidance for VASPs, applicants must present a fully operationalised AML manual, CDD/KYC procedures, ongoing monitoring infrastructure, and an SAR reporting workflow.
• External audit & reporting: Licensed institutions must appoint an external auditor approved by the CNBV and commit to periodic financial and compliance reporting.
• Cyber-security controls: Platform security audits, incident-response plans, and evidence of penetration testing are assessed as part of the application and subject to ongoing review.
• Client-asset segregation: Virtual assets and fiat funds held on behalf of clients must be segregated from the institution’s own balance sheet, with clear trust or custodial arrangements documented.
• Business-plan viability: Three-year financial projections, product roadmap, and market-risk analysis demonstrate the applicant’s commercial sustainability.

Common documentary evidence includes: board resolutions, notarised articles of incorporation, audited financial statements, detailed CVs with notarised copies, technical SOC reports, and AML policy manuals.

Costs, Timelines and Typical Regulator Checkpoints

Budgeting for a crypto licence under the Fintech Law in Mexico should account for several cost categories:

• Application fees: The CNBV charges statutory filing fees; amounts are published in the annual fee schedule (Disposiciones de carácter general).
• Legal & advisory fees: Engaging experienced Mexican fintech counsel typically represents one of the largest cost items. Expect a range that reflects the complexity of the business model and the number of regulated activities sought.
• Compliance tooling: Transaction-monitoring software, KYC identity-verification platforms, and cyber-security audit costs should be budgeted from the outset.
• Capital lock-up: The minimum capital requirement ties up funds for the duration of the licence, an opportunity cost that must be factored into financial planning.

Typical timeline phases run as follows: pre-application preparation (4–10 weeks), formal application review by the CNBV (12–24 weeks), information-request cycles (4–12 weeks), and final decision issuance. End-to-end, most successful applicants report timelines of 6 to 12 months.

The most common reasons for delays are incomplete AML documentation, inadequate technology-security evidence, an unclear or over-ambitious business model, and failure to respond promptly to CNBV information requests.

Post-Licensing Obligations & Enforcement Risk

Obtaining the licence is the beginning, not the end, of the compliance journey. Mexican law imposes continuous obligations on licensed fintech institutions:

• Periodic reporting: Quarterly and annual returns to the CNBV covering financial performance, transaction volumes, and compliance metrics.
• AML monitoring: Ongoing transaction surveillance, updating of risk assessments, and timely SAR filing with Mexico’s Unidad de Inteligencia Financiera (UIF).
• External audit: Annual financial-statement audits and periodic compliance audits conducted by CNBV-approved auditors.
• Consumer-protection disclosures: Prominent risk warnings, fee schedules, and complaints-handling procedures must be accessible to users.
• Advertising restrictions: Marketing materials must not mislead regarding the risks of virtual-asset investment.

Enforcement outcomes for non-compliance include fines, licence suspension, remediation orders, and, in severe cases, criminal referral. Recent regulatory trends across Latin America suggest increasing enforcement intensity, reinforcing the need for sustained compliance investment.

When to Choose Counsel vs DIY A Risk-Based Decision

Some licence-preparation tasks can be handled internally; others demand specialist legal expertise. Situations where external counsel is essential include:

• Complex token classification: When the asset in question could be treated as a security under the investment-contract analysis framework applied by Mexican and international regulators.
• Multi-jurisdictional structuring: Where the business operates across borders and requires coordinated authorisations (e.g., Mexico and the EU under MiCA).
• Enforcement response: Receiving an information request, remediation order, or administrative sanction from the CNBV.
• Sandbox-to-full-licence conversion: Navigating the transition from a temporary Modelo Novedoso authorisation to a permanent licence.

In-house teams can typically manage routine compliance reporting, day-to-day AML monitoring, and internal-policy updates provided they are adequately resourced and trained.

Case Examples & Common Scenarios

Consider a crypto exchange already licensed in one jurisdiction seeking to add custody services for Mexican clients. Under the ITF, custody constitutes a separately regulated activity, requiring either a new licence or an amendment to the existing authorisation; simply extending the exchange product set without regulatory approval is not permissible.

In another scenario, a token issuer evaluating whether to pursue a full CNBV licence or enter via the sandbox regime must weigh speed-to-market against the risk of operating under time-limited, user-capped conditions. Detailed jurisdictional case studies are available as follow-up resources through the crypto licensing: country guides hub and related cluster content.

Conclusion

Mexico’s Fintech Law positions the country as one of the most regulated and one of the most credible environments for crypto operations in Latin America. For businesses that invest in understanding crypto under the Fintech Law (ITF), the reward is access to a large and growing market with clear rules, transparent supervisory expectations, and a framework that international counterparts and banking partners recognise. Whether pursuing a full CNBV licence, an initial sandbox entry, or a multi-jurisdictional strategy that includes Mexico, structured preparation and early engagement with regulatory requirements are the clearest determinants of success.

Navigating the CNBV’s licensing process is rarely a one-time exercise — regulatory guidance, enforcement priorities, and secondary regulations under the Fintech Law continue to evolve, and businesses that stay current tend to avoid the delays that trip up unprepared applicants. For ongoing analysis of crypto licensing trends, AML enforcement patterns, and regulatory developments across Latin America and beyond, visit our legal insights blog, where our team regularly breaks down the regulatory changes that matter most to fintech and crypto businesses.

Sources

• FATF Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers
• FinCEN Guidance & Resources on Virtual Currencies
• SEC Framework for “Investment Contract” Analysis of Digital Assets
• European Commission Markets in Crypto-Assets (MiCA) Regulation
• Bank for International Settlements (BIS) Crypto Regulation & Market Structure Reports