Fintech in Mexico

Fernando Eraña and Carlos Ugalde

What is the general state of fintech innovation in your jurisdiction, including any notable trends, innovations, innovators and future prospects?

The fintech industry in Mexico has grown in recent years. Entrepreneurs with in-depth understanding of technology have focused on providing a more user-friendly banking experience to the general public (ie, fewer onerous requirements and a more efficient operation than traditional financial institutions and models).

According to the Fintech Association of Mexico, as of 2017 there were between 250 and 300 Fintech companies operating in Mexico, reflecting its position as the leader of the industry in Latin America, ahead of even such major markets as Brazil.

The most popular activities for Mexican fintech companies are:

• peer-to-peer lending (23%);
• payments and remittances (22%);
• enterprise financial management (15%); and
• personal financial management (9%)

Key technologies

Have there been any particular developments – regulatory or commercial – in any of the following fintech sectors?

Distributed ledger technology and digital currencies (eg, blockchain, smart contracts and Bitcoin)?

On March 6 2018 the Law to Regulate Financial Technology Institutions was enacted. The law has the purpose of “regulating the provision of financial services through technological innovations” and introduces a legal framework for financial technology institutions (FTIs) and concepts such as cryptocurrencies, crowdfunding platforms and electronic payments. The law foresees the creation of a new set of regulations for FTIs and adapts the legal framework accordingly.

No regulation on ledger technology or smart contracts is expected. Blockchain and smart contracts are virtually non-existent in Mexico. However, cryptocurrencies have been incorporated into legislation under the following principles:

• they will not be considered as legal currency; and
• the Central Bank will issue regulations to determine which cryptocurrencies are authorised in Mexico, as well as their characteristics and the conditions or restrictions on the operations that can be undertaken with them.

Alternative lending platforms?

The Law to Regulate Financial Technology Institutions permits alternative lending and financing platforms, regulates their operations and puts them under the authority of the Banking and Securities Commission (CNBV). The law distinguishes the following types of alternative lending or funding:

• peer-to-peer lending;
• crowdfunding; and
• royalty crowdfunding.

These platforms will be required to comply with specific statutory obligations, including:

• regulations for customer and project selection;
• regulations for the information and documents to be reviewed when analysing customers and projects;
• informing users of the risks involved when investing in alternative lending or funding; and
• informing the credit bureau of a customer’s credit record.

Further regulations will detail the scope and extent of these obligations.

Digital payments, remittances and foreign exchange?

Electronic payments are now subject to regulation. FTIs that operate digital payment services (ie, digital wallet services and mobile wallets) are subject to the authorisation and oversight of the CNBV. The Law to Regulate Financial Technology Institutions defines what can be considered an electronic payment and what is not, and will permit authorised FTIs to provide money-transmitting services and trade with cryptocurrencies, among other activities.

Alternative financing (including crowdfunding)?

The Law to Regulate Financial Technology Institutions provides regulation and supervision for crowdfunding companies, which operate as collective financial institutions through an authorisation provided by the CNBV. The CNBV will grant an authorisation when the requirements under the law and the CNBV’s ancillary regulations are met. Financing platforms should be exempt from filing under securities laws. Ancillary regulations to be issued during 2018 will provide specific rules for crowdfunding.

Investment, asset and wealth management?

No specific legislation has been enacted to regulate investment, asset and wealth management, which is mostly regulated under current securities laws. The Law to Regulate Financial Technology Institutions will now permit authorised institutions to operate with certain cryptocurrencies pre-authorised by the Central Bank. However, securities are excluded from the law; the trade in securities requires authorisation to operate as a securities intermediary or financial adviser.

Robo-advice and artificial intelligence?

No legislation exists in this regard and none is expected. Mexican civil law acknowledges the principle of ‘objective liability’, in which a person using mechanisms or instruments capable of causing damage is personally liable for such damage and losses. The use of robo-advice and artificial intelligence arguably falls within this standard; however, a more thorough discussion is clearly required to address the challenges of robo-advice and artificial intelligence.

Any other technologies?

The Law to Regulate Financial Technology Institutions focuses on alternative financing platforms, electronic payments and cryptocurrencies, but also permits the creation of a regulatory sandbox for innovative technologies. This allows new technology to be tested on a limited audience and benefit from a time-limited exemption from regulatory requirements.

Regulatory issues

Regulatory approach

How would you describe the regulatory policy for fintech products and services in your jurisdiction?

The Law to Regulate Financial Technology Institutions and its ancillary regulations intend to regulate products and services rendered in Mexico. It is yet to be seen whether regulatory policy becomes a barrier of entry for new players or whether it is reasonable; nonetheless, it is expected that on issuance of ancillary regulation, many currently operating financial technology institutions (FTIs) will not survive.

Have any fintech-specific laws or regulations been enacted in your jurisdiction? Are any envisaged?

Previous reforms to commercial regulations provided three key elements to make electronic transactions (including peer-to-peer lending) reliable:

• electronic signature – the law requires electronic signatures to contain specific information, passwords and keys to verify that the corresponding party is validating the transaction and avoid identity fraud;
• functional equivalence – for legal purposes it is assumed that if a transaction is signed with a valid electronic signature, it has the same validity as if it were executed in paper; and
• evidence in court – information shared through electronic devices at the moment of transaction can be filed as evidence in court, having the same legal and binding effects as traditional paper-backed evidence.

As of April 2018 the only piece of legislation enacted has been the Law to Regulate Financial Technology Institutions. Ancillary regulation will follow in 2018. Following the promulgation of the law:

• the Ministry of Finance must issue:
  • the general rules for the operations of FTIs (eg, mechanisms to prevent money laundering and reporting obligations to authorities, internal committees and internal or external audits) within six months; and
  • the rules for granting temporary authorisations to sandbox companies within 12 months;
• the Banking and Securities Commission (CNBV) must issue within six months:
  • general rules for offering crowdfunding services;
  • rules for minimum capital requirements for FTIs; and
  • rules for filing for the authorisation to operate as an FTI; and
• the Central Bank must issue the rules for operating with cryptocurrencies within six months.

Regulatory authorities

Which government authorities regulate the provision of fintech products and services?

Several government authorities will regulate the provision of fintech products and services:

• The CNBV will regulate the authorisation process for fintech businesses (eg, electronic fund institutions and collective financial institutions);
• The Central Bank will regulate:
  • the operation and activities of electronic fund institutions;
  • certain operations performed by the collective financial institutions; and
  • operations with virtual assets (ie, cryptocurrencies).
• The National Commission for the Protection of Financial Services Users (CONDUSEF) will regulate contract templates to be used by FTIs and management processes for legal claims in disputes between FTIs and their clients; and
• The National Commission for Retirement Savings (CONSAR), the CNBV, CONDUSEF and the National Insurance and Bonding Commission (CNSF) will regulate the registry for the regulatory sandbox for innovative technologies, as applicable.

Each of these authorities will issue specific ancillary regulations to fulfil its respective obligations.

Financial regulatory framework

Which laws and regulations governing the provision of financial services apply to fintech businesses?

As of now, the following legislation applies to FTIs:

• the Law to Regulate Financial Technology Institutions;
• the Credit Institutions Law;
• the Law to Protect Customers of Financial Services; and
• the Federal Law to Prevent and Identify Activities with Illegal Resources.

Also, ancillary regulation to the Law to Regulate Financial Technology Institutions is to be enacted by several government authorities, including:

• the Central Bank;
• CONDUSEF;
• CONSAR;
• the CNBV; and
• the CNSF.

Under what conditions are fintech businesses subject to licensing requirements? Are there any exemptions?

Under the Law to Regulate Financial Technology Institutions, all fintech businesses require licensing. New fintech businesses must obtain authorisation from the CNBV. Fintech businesses currently operating may continue to do so but will need to obtain proper authorisation as new regulations are promulgated. A regulatory sandbox has been provided for new technologies (with the exception of crowdfunding and electronic payment funds). Regulatory sandbox status may be granted by the CNBV with a temporary authorisation to operate without fully complying with all applicable requirements.

Are any fintech products or services prohibited in your jurisdiction?

No. With the recent enactment of the Law to Regulate Financial Technology Institutions, fintech services and products such as crowdfunding services, electronic payments and operations with cryptocurrencies will be authorised under Mexican law.

Data protection and cybersecurity

What rules and regulations govern the processing and transfer (domestic and cross-border) of data relating to fintech products and services?

Pursuant to the General Law to Protect Personal Data in Possession of Individuals, FTIs must put in place mechanisms to protect any information received from their individual clients, including posting privacy notices on their websites and platforms. FTIs may share information only in the cases specified in their privacy notices or in specific circumstances (eg, providing information to parent companies or subsidiaries, or providing information to authorities due to public interest or a court ruling). These obligations are not exclusive to FTIs but apply to all private entities receiving information from individuals. Under the Law to Regulate Financial Technology Institutions all information regarding an FTI’s activities and clients must be treated as confidential and may not generally be disclosed to any third party.

What cybersecurity regulations or standards apply to fintech businesses?

No cybersecurity regulations are presently applicable to fintech businesses or services. Nevertheless, the Law to Regulate Financial Technology Institutions provides that its ancillary regulation may include provisions regulating the use of electronic equipment and automated data processing systems by FTIs. FTIs will most likely have to report certain information to the CNBV, CONDUSEF and the Central bank in connection with their activities and operations. Appropriate regulation will be issued within six months of publication of the Law to Regulate Financial Technology Institutions, which took place on March 6 2018.

Financial crime

What anti-fraud, anti-money laundering or other financial crime regulations govern the provision of fintech products and services?

Pursuant to the Federal Law to Prevent and Identify Activities with Illegal Resources, financing not granted by financial institutions (including financial non-bank institutions) is now considered a ‘vulnerable activity’ (ie, an activity that is vulnerable to money laundering). Therefore, FTIs focused on peer-to-peer lending must obtain certain personal information from borrowers, including information regarding their partners or shareholders if the borrower is a corporation. FTIs doing peer-to-peer lending must file periodic notices to the tax authorities, including information about the borrowers and the FTI, as well as a brief description of the vulnerable activity. Failure to comply with such provisions may result in penalties for the FTI.

The Federal Law to Prevent and Identify Activities with Illegal Resources and the ancillary provisions issued by the Ministry of Finance require other FTIs (including those focused on alternative financing platforms, electronic payments and cryptocurrencies) to issue measures and procedures to detect acts or omissions in connection with illicit activities such as financing terrorism (as defined by the Federal Criminal Code). FTIs must submit to the CNBV their measures and procedures pursuant to the terms, conditions and requirements set in the ancillary provisions. They must also develop and implement a methodology to carry out risk evaluations for occasions in which third parties might use them to perform acts or omissions in connection with illicit activities.

What precautions should fintech businesses take to ensure compliance with these provisions?

Pursuant to the Law to Regulate Financial Technology Institutions, FTIs must have extensive internal policies describing the information that must be obtained from their clients and ensure that their employees comply with these policies. Further, FTIs dedicated to peer-to-peer lending must provide periodic notice to the tax authorities as specified in the Federal Law to Prevent and Identify Activities with Illegal Resources.

Also pursuant to the ancillary provisions to be issued in this respect, FTIs may be required to comply with reporting obligations and establish measures and procedures to detect acts or omissions in connection with illicit activities such as financing terrorism (as defined in the Federal Criminal Code).

Consumer protection

What consumer protection laws and regulations apply to the provision of fintech products and services?

Fintech products and services must comply with:

• the provisions of the Law to Regulate Financial Technology Institutions that cover consumer protection (eg, the obligation to provide clients with receipts of each operation made or account statements proving such operations); and
• the general provisions of the Law to Protect Customers of Financial Services (eg, the obligations to keep information received from customers confidential and – especially – the provisions regarding operations made though electronic means).

Competition

Does the provision of fintech products or services in your jurisdiction raise any particular competition regulatory concerns?

Based on the Law to Regulate Financial Technology Institutions and the current regulations, there are no competition regulatory concerns that apply specifically to fintech products or services.

Cross-border regulation

Are there any particular regulatory issues concerning the cross-border provision of fintech products and services (eg, operating jurisdiction rules and currency controls)?

No.

Financing, investment and government support

Government support

Does the government provide any incentives or support programmes to promote fintech innovation in your jurisdiction (eg, tax incentives, grants and regulatory sandboxes)?

Government authorities have not issued any tax incentives promoting fintech businesses in Mexico. While the ancillary provisions to be issued by the Ministry of Finance or the Banking and Securities Commission (CNBV) may result in such incentives, these will not be determined until the provisions are issued.

Certain government institutions provide funding to start-ups, including fintech start-ups. The National Institute for Entrepreneurs provides benefits for financial technology institutions (FTIs), including support for their products and the provision of working tools. FTIs can also apply for financial support by responding to calls posted in the operation rules of the National Institute for Entrepreneurs (found in the Mexican Official Gazette).

The Law to Regulate Financial Technology Institutions foresees regulatory sandboxes for FTIs, as long as they provide services – other than crowdfunding or electronic payment funds – using new technologies. FTIs subject to regulatory sandboxes will be granted a temporary authorisation to operate without fully complying with all of the regulations applicable to fintech businesses and FTIs, as discretionally resolved by the corresponding financial authorities (ie, the Supervisory Commissions, the Central Bank and the Ministry of Finance).

Has the government concluded any international cooperation agreements to promote and facilitate the cross-border expansion of fintech businesses?

The government has not entered into international agreements to promote cross-border expansion of fintech businesses.

Financing and investment

What private financing and investment schemes are available and commonly used for fintech start-ups in your jurisdiction?

 Several private organisations in Mexico (eg, Startup Mexico, Venture Institute and Angel Ventures Mexico) provide funding and business advisory and mentoring for start-ups and have been deeply involved in developing FTIs in recent years. Many venture capital funds invest in seed, early stage and growth capital for FTIs. Such private organisations contribute to promoting innovation and entrepreneur culture in Mexico, with the goal of local and international economic development. They convoke entrepreneurs that are interested in establishing cooperative relationships and providing seed capital and services to promote businesses; the calls are usually open to students, entrepreneurs, mentors, investors and companies.

Ancillary issues

IP rights

What forms of IP protection are available for fintech innovations?

The most common way to protect fintech innovations is through copyright. Databases and software can both be protected by copyright. Further, business models and mathematical innovations (ie, algorithms) can be protected as literary works or software (through registration at the National Institute of Copyright) or as industrial secrets.

Patents are not a good recourse for FTIs, since they protect only physical inventions (software is subject to copyright protection). If a company were to invent a new physical form of data storage or make unique changes to servers, the innovation would be eligible for patent protection.

FTIs can also register trademarks and ‘avisos comerciales’ (commercial advertisements) for their slogans.

What rules govern the ownership of IP rights to fintech innovations?

IP rights are governed by the Federal Law on Copyright and the Industrial Property Law.

Immigration

What immigration schemes are available for fintech businesses to recruit skilled staff from abroad? Are there any special regimes specific to the tech or financial sector?

There are no special immigration schemes for FTIs. All businesses in Mexico must take into account that only 10% of their employee base can be foreign (with the exception of directors, administrators, and general managers). In order to employ any foreign workers, the business must register with the National Institution for Migration; it must then present the National Institution for Migration with its employer registration and proof of an existing employment offer. All foreign employees working in Mexico must register for a visa. If the business wants to employ someone for less than 180 days, the employee may not have to register for a visa (depending on his or her country of origin).

Despite this, there has been a drive to attract talent in Guadalajara, Jalisco State, which aims to recruit talented people from other countries, particularly technology and software professionals, to contribute added value to Mexican industry. Jalisconnect is a programme for international entrepreneurs and start-ups created by Jalisco’s government and the Mexican consulate in San Francisco. It has launched two further programmes: Soft Landing and Digital Bridge. Soft Landing is intended to attract talent from California to Mexico, while Digital Bridge connects Mexican entrepreneurs with other foreign technology programmes, with the main purpose of obtaining financial aid.

There is also a visa, known as a ‘tech visa’, which allows foreigners to work in Mexico as entrepreneur mentors. Applicants must comply with requirements, which include being an employee or owner of a company incorporated in the United States and earning a minimum monthly wage of $1,500. The tech visa procedure can be performed in the Mexican consulate by filing a required form and paying a fee of $36. The visa is issued 24 hours after the request.

What immigration schemes are available for foreign investors and entrepreneurs wishing to invest in or establish a fintech business in your jurisdiction?

Jalisconnect is a programme for international entrepreneurs and start-ups created by Jalisco’s government and the Mexican consulate in San Francisco. It has launched two further programmes: Soft Landing and Digital Bridge. Soft Landing is intended to attract talent from California to Mexico, while Digital Bridge connects Mexican entrepreneurs with other foreign technology programmes, with the main purpose of obtaining financial aid.

There is also a visa, known as a ‘tech visa’, which allows foreigners to work in Mexico as entrepreneur mentors. Applicants must comply with requirements, which include being an employee or owner of a company incorporated in the United States and earning a minimum monthly wage of $1,500. The tech visa procedure can be performed in the Mexican consulate by filing a required form and paying a fee of $36. The visa is issued 24 hours after the request.

Foreign investors must comply with the general limits imposed in the Foreign Investment Law. Limits may apply depending on the activity being performed; nevertheless, no limits are foreseen for fintech services and products.

Companies with foreign investments must be registered in the Foreign Investment Registry and renew their registration annually in the cases established under law. Registered companies must file a quarterly update report before the Foreign Investment Registry:

• in the event of changes or amendments in information previously provided; or
• if the foreign participation, income, disbursements or account entries exceed Ps20 million (approximately $1,080,000). 

Original