Mexico's Crypto Market Operates in Regulatory Limbo Eight Years After Fintech Law

Mexico's Ley Fintech was supposed to bring clarity. Passed in March 2018, it was the first dedicated fintech law in Latin America, covering electronic payments, crowdfunding, and virtual assets. Eight years on, the secondary regulations needed to fully implement the crypto provisions remain incomplete. The result: roughly 800 fintech companies operate in a framework that is half-built, with crypto exchanges falling through the widest gap.

What the law says versus what exists

The Ley Fintech created two categories of regulated fintech institutions (ITFs): electronic payment institutions (IFPEs) and crowdfunding institutions (IFCs). Virtual assets are recognized but explicitly declared not to be legal tender under Article 30. Three regulators share oversight: CNBV handles licensing and supervision, Banxico controls which virtual assets can be used, and SHCP manages tax and AML policy.

The catch is Circular 4/2019. Banxico's 2019 directive prohibits banks and licensed fintech institutions from offering crypto-related services directly to the public. They can only conduct internal crypto operations with prior Banxico approval. This effectively means the entities best positioned to offer regulated crypto services, those already licensed as IFPEs, cannot do so.

Crypto exchanges that serve Mexican retail customers operate outside the ITF framework entirely. They register as "vulnerable activities" under Mexico's anti-money laundering law, which requires KYC, transaction monitoring, and reporting to SHCP. But vulnerable activity registration is not a license. It imposes obligations without granting legitimacy or consumer protections.

The secondary regulation gap

The Ley Fintech delegated significant detail to secondary regulations, including open banking rules and more specific crypto provisions. As of early 2026, the open banking implementation is substantially delayed. Only data-sharing rules for ATMs and branch locations are fully operational. Transaction data exchange and payment initiation services, the parts that would actually matter for crypto integration, remain pending.

Mexico's CNBV and Banxico have discussed expanding the regulatory perimeter to include NFTs, DeFi protocols, stablecoins, and smart contracts. A permanent regulatory sandbox has been proposed. None of these have materialized into binding rules.

What operates and how

Bitso, Latin America's third-most-valuable fintech, dominates Mexico's crypto market from this legal gray zone. It and other exchanges process billions in volume annually while technically operating as vulnerable activity registrants rather than licensed financial institutions. The 2023 and 2024 legislative amendments that recognized blockchain's evidentiary value in legal proceedings did not change the licensing picture.

Penalties for actual violations are severe: fines up to license revocation, account freezes, and criminal prosecution. But these penalties apply to licensed ITFs. For unregistered crypto exchanges, enforcement operates through the AML framework, which is reactive rather than preventive.

The January 2024 reform to the Ley Fintech was the most recent legislative change, but it did not address the secondary regulation gap for virtual assets. Until Banxico revises Circular 4/2019 or CNBV finalizes crypto-specific licensing rules, Mexico's crypto market will continue operating in a framework designed for a different era. Eight years is a long time to stay interim.