1 Legal and enforcement framework

1.1 In broad terms, which legislative and regulatory provisions govern the fintech space in your jurisdiction?

The general regulatory framework for financial technology institutions in Mexico is set out in the Financial Technology Institutions Law.

Likewise, the General Provisions for Financial Technology Institutions establish rules for fintech companies in relation to the following issues, among others:

  • minimum capital requirements;
  • fund transfer limits;
  • cash in and cash out restrictions;
  • filing requirements; and
  • financial reporting obligations.

Finally, several administrative rules and provisions regulate specific matters, such as the following:

  • the General Provisions for Electronic Money and Payment Institutions;
  • the General Provisions on the Prevention of Money Laundering and Terrorist Financing under Article 58 of the Fintech Law;
  • the General Provisions on Cryptocurrency Operations (4/2019);
  • the General Provisions on the Information Regarding Activities that must be Reported to the Financial Authorities under Articles 57 and 84 of the Financial Technology Institutions Law;
  • the General Provisions for Crowdfunding Institutions; and
  • the Administrative Rules to Establish Additional Criteria and Conditions to Grant Temporary Authorisation for the Operation of Innovative Models.

1.2 Do any special regimes apply to specific areas of the fintech space?

Article 80 of the Financial Technology Institutions Law allows fintech companies to operate on a temporary basis under an innovative model authorisation or ‘regulatory sandbox'. The regulatory sandbox is available for institutions that offer financial services using innovative technological tools which will have a positive social impact. It provides fintech companies with a testing ground for new business models that are not covered by existing regulation.

1.3 Which bodies are responsible for enforcing the applicable laws and regulations? What powers do they have?

Under Article 3 of the Financial Technology Institutions Law, the National Banking and Securities Commission (CNBV) and the Central Bank of Mexico (Banxico) are the authorities responsible for enforcing the law and its secondary provisions.

Under Article 71 of the law, the CNBV is the financial authority with responsibility for the operations of fintech companies in Mexico. The CNBV has supervisory powers and can perform audits upon request.

Likewise, the Finance Ministry, the National Commission for the Pension Saving System, the National Commission for the Protection and Defence of Financial Services Users and the National Insurance and Bonding Commission have supervisory powers in terms of their applicable laws.

1.4 What is the regulators' general approach to fintech?

The regulators seek to:

  • provide legal certainty and protection for fintech users;
  • prevent money laundering and operations using illegal resources; and
  • promote a secure environment for the development of the financial industry in Mexico.

1.5 Are there any trade associations for the fintech sector?

Fintech Mexico is a fintech trade group which brings together more than 70 fintech companies in Mexico. It has become one of the key players in the sector. Since 2015, Fintech Mexico has been working hand in hand with the government to promote a legal framework that facilitates fintech development in Mexico.

2 Fintech market

2.1 Which sub-sectors of the fintech industry have become most embedded in your jurisdiction?

Of the operating fintech companies and start-ups active in Mexico, over 40% are involved in the payments and remittances and consumer lending sub-sectors, followed by corporate and personal financial management, business lending and crowdfunding.

2.2 What products and services are offered?

Currently the main products and services offered in the market include lending, payments and remittances, financial management, enterprise technologies for financial institutions, insurance, alternative scoring, identity and fraud prevention services, digital banking, trading and capital markets, and wealth management, among others.

2.3 How are fintech players generally structured?

Structures vary depending on the capital and size of the fintech company According to a report issued by Finnovista, over half of Mexico's fintech companies employ fewer than 10 people, while only 8% have more than 50 employees.

2.4 How are they generally financed?

According to a report issued by Finnovista, 65% of Mexican fintech companies received foreign investment in 2017, to a total of approximately $80 million. Likewise, 50% of the fintech companies surveyed mentioned that they had received investment from angel investors, and 20% from friends and family.

2.5 How are they positioned within the broader financial services landscape?

Some fintech companies compete directly with traditional banking and financial institutions, while others partner with existing institutions. A survey conducted by Finnovista reveals that the majority of Mexican fintech companies have business models aimed at financially excluded markets.

2.6 Do start-ups generally outsource back office functions and is there a developed market for them to access? What are the legal implications of outsourcing?

According to Article 54 of the Fintech Law, fintech companies can work with domestic or foreign third-party service and technology providers in order to successfully carry out and fulfil their operations.

The National Banking and Securities Commission and the Central Bank of Mexico have the powers to supervise such third-party providers at all times. These supervisory powers include the power to request that an audit be performed on the third-party provider. To this end, the purpose of any inspection or audit request must be specified and its scope limited to the extent of the service being outsourced, in compliance with the provisions of the Financial Technology Institutions Law and its secondary regulations.

3 Technologies

3.1 How are the following key technologies in the fintech space regulated and what specific legal issues are associated with each? (a) Internet (e-commerce); (b) Mobile (m-commerce); (c) Big data (mining); (d) Cloud computing; (e) Artificial intelligence; and (f) Distributed ledger technology (Blockchain, cryptocurrencies)

(a) Internet (e-commerce)

Article 89 of the Commercial Code allows for the use of electronic means for commercial purposes. Likewise, the Federal Civil and Commercial Codes contain chapters that recognise electronic channels as a valid and legitimate means to express consent and establish obligations and rights among the parties.

Furthermore, the Federal Consumer Protection Law and Official Mexican Standard NMX-COE-001-SCFI-2018 (NMX) regulate e-commerce in Mexico.

The Federal Consumer Protection Law addresses the consumer-oriented obligations that e-commerce players have to consumers. The NMX is a non-binding regulation, but establishes specific mechanisms that providers might adopt to provide consumers with secure services.

(b) Mobile (m-commerce)

The Mexican regulatory framework does not distinguish between e-commerce and m-commerce, given that the definition of ‘e-commerce' is broad enough to encompass both. Therefore, the e-commerce rules discussed in question 3.1 will also apply to m-commerce.

(c) Big data (mining)

No specific regulations exist as yet.

(d) Cloud computing

Cloud computing is addressed within the Mexican legal framework only with regard to data protection. Article 52 of the Rules of the Federal Law for Personal Data Protection in Possession of Private Parties establishes the obligations that those engaging in cloud computing services must meet in order to protect personal data.

Likewise, and in terms of Article 52, the National Institute for Transparency, Access to Information and Personal Data Protection has issued a guide on cloud computing services rules. Therefore, fintech companies must adhere to such rules whenever their contracted cloud computing services directly or indirectly affect personal data.

(e) Artificial intelligence

Artificial intelligence is not yet regulated under Mexican law.

(f) Distributed ledger technology (Blockchain, cryptocurrencies)

Distributed ledger technology is not yet regulated under Mexican law.

4 Activities

4.1 How are the following key activities in the fintech space regulated and what specific legal issues are associated with each? (a) Crowdfunding, peer-to-peer lending; (b) Online lending and other forms of alternative finance; (c) Payment services (including marketplaces that route payments from customers to suppliers (eg, Uber and AirBnb); (d) Forex; (e) Trading; (f) Investment and asset management; (g) Risk management; (h) Roboadvice; and (i) Insurtech.

(a) Crowdfunding, peer-to-peer lending

Articles 15 to 21 of the Financial Technology Institutions Law regulate crowdfunding institutions. Crowdfunding institutions are classified as entities that connect investment seekers with potential investors from the general public through the use of electronic applications, interfaces, websites or any other electronic and digital means of communication which allows applicants and potential investors to carry out financing and investment activities among themselves.

Article 16 of the law regulates three types of crowdfunding models:

  • debt financing, where investors provide financing with direct or contingent liabilities for the applicants;
  • equity investments, where investors own instruments representing equity in the applicants; and
  • profit sharing or royalties, which allow investors to participate under joint venture structures in projects developed by the applicants.

(b Online lending and other forms of alternative finance

The Financial Technology Institutions Law does not include specific online lending regulations. However, Article 27 allows e-money and payment institutions to grant users overdrafts.

(c) Payment services (including marketplaces that route payments from customers to suppliers (eg, Uber and AirBnb)

E-money and payment institutions are regulated under Articles 22 to 25 of the Financial Technology Institutions Law. Authorised institutions can issue, manage, transfer and account e-money and payments through electronic applications, interfaces, websites or any other electronic or digital means of communication.

Marketplaces that route payments from customers to suppliers are not regulated under the Financial Technology Institutions Law.

(d) Forex

General Provision 12/2018 issued by Banxico establishes the terms and conditions for e-money and payment institutions with regard to operations in foreign currency; while General Provision 6/2019 regulates the operations of crowdfunding institutions in foreign currency.

In general, all operations in foreign currencies made by fintech companies require the prior authorisation of Banxico.

(e) Trading

Trading is not regulated under the Financial Technology Institutions Law.

(f) Investment and asset management

The Mexican fintech regulatory framework does not include specific regulations on investment and asset management as yet.

(g) Risk management

The Mexican fintech regulatory framework does not include specific risk management regulations as yet.

(h) Roboadvice

The Mexican fintech regulatory framework does not include specific roboadvice regulations as yet.

(i) Insurtech

The Mexican fintech regulatory framework does not include specific insurtech regulations as yet.

5 Data security and cybersecurity

5.1 What is the applicable data protection regime in your jurisdiction and what specific implications does this have for fintech companies?

Chapter VI of the General Provisions for Financial Technology Institutions sets out data security and cybersecurity regulations for fintech companies. In this regard, the technological infrastructure of fintech companies must include security measures for the protection of user data, including:

  • identification and authentication mechanisms;
  • relevant controls for employees who have access to personal data;
  • internal policies and procedures for data access and prevention of unlawful data use; and
  • measures for the notification of privacy notice changes to users.

Finally, fintech companies are responsible at all times for the protection of users' personal data.

5.2 What is the applicable cybersecurity regime in your jurisdiction and what specific implications does this have for fintech companies?

According to Article 67 of the General Provisions for Financial Technology Institutions, fintech companies must prevent and report to the National Banking and Securities Commission (CNBV) any cybersecurity incidents that occur. Fintech companies must immediately investigate the cause of the incident and provide the CNBV with a plan that outlines the actions that will be taken to eliminate or mitigate the risks that have arisen from the incident.

6 Financial crime

6.1 What provisions govern money laundering and other forms of financial crime in your jurisdiction and what specific implications do these have for fintech companies?

Under the Anti-money Laundering Rules, the National Banking and Securities Commission and the Finance Ministry have established the minimum measures and requirements that fintech companies must comply with in order to prevent and detect actions, omissions and operations that could lead to, aid, promote or cooperate in any way with felonies involving transactions in illegally obtained resources or terrorist financing.

The Anti-money Laundering Rules address the mechanisms and procedures that fintech companies must take into account in order to prevent and detect fraudulent transactions, as well as other compliance and reporting obligations.

7 Competition

7.1 Does the fintech sector present any specific challenges or concerns from a competition perspective? Are there any pro-competition measures that are targeted specifically at fintech companies?

The Mexican regulatory framework does not include pro-competition measures that are targeted specifically at fintech companies.

8 Innovation

8.1 How is innovation in the fintech space protected in your jurisdiction?

No specific innovation protection regulations for fintech companies are currently in place.

8.2 How is innovation in the fintech space incentivised in your jurisdiction?

The Mexican authorities have not issued specific legislation regarding innovation protection for fintech companies. As mentioned in question 1.2, innovation is promoted through a regulatory sandbox, which provides fintech companies with a testing ground for new business models not covered by existing regulations. The regulatory sandbox allows fintech companies to experiment with innovative products in a controlled environment with limited regulatory oversight.

Additionally, the Financial Technology Institutions Law created the Financial Innovation Group, a forum for start-ups, banks and public sector entities to promote fintech development in Mexico.

9 Talent acquisition

9.1 What is the applicable employment regime in your jurisdiction and what specific implications does this have for fintech companies?

The Federal Employment Law sets out all general and specific obligations applicable to employers, including foreign employers of Mexican individuals.

Therefore, employers must comply with the following, among others:

  • Mexican law, when hiring Mexican employees who render their services inside or outside the country (Article 10 and Articles 20, 21, and 24 to 28-D);
  • the obligation to pay all applicable salaries and duties (ie, social security, pensions) (Article 132(II) and Articles 143(a) to (g)); and
  • outsourcing obligations, if acting either as an outsourcing company or as the employer of an outsourcing company (Articles 15(A) to (D)).

In this regard, whenever a fintech company hires a Mexican employee, it must do so under Mexican law and will be subject to the Mexican employment, social security and tax regulatory framework.

9.2 How can fintech companies attract specialist talent from overseas where necessary?

The financial services industry in Mexico has evolved thanks to the emergence of new technologies. Mexico recently cemented its position as the largest fintech hub in Latin America, with more than 394 operating fintech companies – just ahead of Brazil, which has 380.

Therefore, the Mexican market affords abundant opportunities both for fintech companies and for talented individuals who might wish to join them.

10 Trends and predictions

10.1 How would you describe the current fintech landscape and prevailing trends in your jurisdiction? Are any new developments anticipated in the next 12 months, including any proposed legislative reforms?

Mexico's fintech ecosystem has evolved to become one of the most developed and dynamic in Latin America. The Mexican market affords abundant opportunities for fintech companies, due to low penetration of financial services and a young, tech-savvy consumer base.

On 25 September 2019 all operating fintech companies in Mexico will become formally regulated under the Financial Technology Institutions Law. After this deadline, the National Banking and Securities Commission (CNBV) and the Interinstitutional Committee – comprised of members of the CNBV, Banxico and the Finance Ministry – will have six months to grant or deny individual authorisations. This will represent an important step in the consolidation of fintech companies and mark the start of a new chapter in terms of fintech regulation in Mexico.

Secondary regulation and provisions – such as open banking rules, outsourcing rules for e-money institutions and technological infrastructure guidelines – will be published in the coming months.

Therefore, the next few months will be critical to the development of the Mexican fintech ecosystem. The implementation of the Financial Technology Institutions Law and the introduction of secondary legislation will promote fintech investment, public support and consumer involvement in the sector.

11 Tips and traps

11.1 What are your top tips for fintech players seeking to enter your jurisdiction and what potential sticking points would you highlight?

The process for obtaining authorisation may take some time and requires a high level of detail in terms of the documentation that must be submitted to the National Banking and Securities Commission. This includes, among other things, information on the following:

  • operation model;
  • business plan;
  • shareholders;
  • capital and corporate structure;
  • board of directors;
  • financial viability; and
  • compliance policies.

To navigate the authorisation process, sound legal and financial advice and an experienced in-house team are crucial.

Fintech companies must also appreciate that this is not a one-step process, but will rather require ongoing contact and communication with the financial authorities through the proper channels.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.