Digital asset regulation and tokenization in Mexico

In Mexico, a business tokenizing debt and one providing virtual asset exchange services must begin with different questions. The former needs to define the instrument and how it is offered or transferred; the latter must identify its functions and whether it falls within the financial or vulnerable-activity perimeter. Using the same technology does not give them the same permissions.

This distinction is especially important when designing custody and the movement of funds. The Fintech Law, Banxico restrictions and AML duties apply to specific entities and activities. This guide explains those differences and the timetable of rules published in 2026, separating future requirements from obligations already applicable.

Which activities the Fintech Law and Banxico rules cover

The Law to Regulate Financial Technology Institutions, commonly called the Fintech Law, regulates specified financial activities, rather than every business using a distributed ledger. Article 30 defines virtual assets for that framework and assigns functions to Banco de México. Classification must consider the asset, service and provider; a token, stablecoin or technology platform label is insufficient.

Provision 3 of Circular 4/2019 allows banks and financial technology institutions, ITFs, to undertake specified internal operations with prior authorization. Operations intended to provide exchange, transfer or custody of virtual assets directly to their customers are ineligible for that permission. This institutional restriction should not automatically be extended to all activities of private providers outside those categories.

The roles of CNBV, Banxico and the AML authorities

The National Banking and Securities Commission, CNBV, authorizes ITFs following agreement by the Interinstitutional Committee and supervises securities market activities within its remit. Banco de México regulates and authorizes operations covered by its rules. Permission as an electronic payment funds institution does not itself include authorization to offer every virtual asset service.

For preventive compliance, the Ministry of Finance and Public Credit, SHCP, acts through the Financial Intelligence Unit, UIF, and the Tax Administration Service, SAT. Articles 17 and 18 of the AML law cover specified non-financial providers. Vulnerable activity registration and reporting serve that purpose; they do not certify solvency, technological security or approval of traded assets.

How market access depends on the service provided

Article 17.XVI of the AML law covers regular professional exchange by persons other than financial entities and platforms facilitating purchases, sales or covered custody, storage and transfer facilities. Since the July 2025 amendment, it expressly includes operations with Mexican citizens from another jurisdiction. An overseas structure does not justify assuming automatic exclusion from local duties.

Access requires a function-by-function assessment: preventive registration for the vulnerable activity and additional financial permission for reserved activities. Fintech Law Articles 15 and 22 define crowdfunding and electronic payment funds activities. Using separate group companies does not make a reserved activity unrestricted if one of those companies still performs it.

The innovative models framework in Article 80 of the Fintech Law allows companies other than ITFs and supervised entities to obtain temporary, conditional authorizations of up to two years within the powers of each authority. It is not a general authorization for tokenization, stablecoins or decentralized finance. The specific authorization, participants, operations and exit conditions must be checked before treating a pilot as a stable commercial route.

How tokenized rights are documented and transferred

The Securities Market Law remains relevant where an instrument meets the legal characteristics of a security. Articles 7 and 8 distinguish public offerings requiring registration from specified private offering cases. Digital distribution does not itself make a public offering private. Under Article 9, intermediation in registered securities is reserved to authorized entities.

Articles 5 and 5 Bis of the General Law of Negotiable Instruments and Credit Transactions, amended on 26 March 2024, allow negotiable instruments to be issued electronically through an information system. The written-form requirement is met where the law expressly permits it and the instrument remains complete and available; signatures must be attributable under the Commercial Code. Articles 26 and 29 link endorsement to the relevant information system. This provides a legal basis for electronic instruments satisfying those requirements, rather than automatic validity for any token or smart contract.

A project must identify the obligor, incorporated right, relevant register and legally effective transfer method. A token linked to real estate does not itself establish ownership; nor does a digital copy automatically replace the required instrument or register. Technical architecture must preserve the relationship between holder, instrument and rights, including incident handling and enforcement procedures.

Which AML duties apply and when they change

The 2025 AML amendment requires identification, beneficial owner information, registration and record retention of at least ten years for covered persons. Article 17.XVI sets reporting triggers for transactions from 210 times the daily Measurement and Updating Unit, UMA, or service fees from four times that value. These are different triggers, not a single customer threshold. Where one transaction meets both, Article 31 Bis of the Regulations, amended on 27 March 2026, requires a single report based on the transaction amount.

Agreement 115/2026, published on 7 August 2026, sets out detailed originator, recipient and wallet information requirements and rules on custody and intermediation. It generally enters into force on 30 November 2026. Transitional provisions set 1 March 2027 for the risk assessment and specified customer controls, and 1 June 2027 for automated mechanisms; the first audit period is 2028. Providers already registered must update their information within six months of its entry into force. These developments are not described as already mandatory in October.

The law also requires reports within 24 hours of a suspicion or of becoming aware of facts or indications, even if the transaction was not completed. The FIU resolution published on 24 September 2026 amends the official reporting formats, including the virtual asset format, and provides that these 24-hour reports are filed using the new formats from 1 June 2027. Each provider must check the procedure applicable to amount-based reports and suspicion reports, without interpreting that timetable as suspending existing preventive duties.

What to define before developing the platform

Project preparation should connect each technical function to the entity performing it: issuance, placement, receipt of funds, exchange, custody and transfer. Use that map to assess which activities need financial authorization and which require AML registration, identification or reporting. This should happen before promising customers a service that the contracting entity cannot provide.

For a tokenized offering, the next step is to specify the holder’s right and the procedure for transferring, collecting or enforcing it. Technical controls should support those legal requirements. Virtual asset providers need a separate timetable for adapting data, procedures and systems to the 2026 rules; bank account availability, taxation and cross-border operations require further checks.

To understand how this framework applies to your project, discuss your case with our team.