RESEARCH: Mexico Virtual Asset Securities Regulation

Executive Summary

• Virtual assets are legal in Mexico, but are not recognized as currency; the Bank of Mexico (Banxico) has explicitly prohibited financial institutions from offering crypto services without prior authorization, and the general public is largely restricted from crypto exposure through the regulated financial system Ley para Regular las Instituciones de Tecnología Financiera.
• The primary regulator is the Bank of Mexico (Banxico) for monetary policy and payment systems, the National Banking and Securities Commission (CNBV) for banking and securities oversight, and the Ministry of Finance (SHCP) for fintech regulation; the Financial Intelligence Unit (UIF) oversees AML compliance Ley para Regular las Instituciones de Tecnología Financiera.
• The Law to Regulate Financial Technology Institutions (Ley Fintech), published in the Official Gazette (DOF) on March 9, 2018, establishes the sole licensing regime for virtual asset activity; however, as of December 2025, no institution has been granted a virtual asset operations license — only two institutions have received fintech crowdfunding licenses, and zero have received virtual asset licenses Diario Oficial de la Federación DOF 09-03-2018.
• The practical reality is severely restrictive: the secondary legislation (Circular 4/2019) from Banxico prohibits banks and fintechs from offering crypto to retail clients without explicit authorization, and no such authorizations have been granted; the market operates in a gray zone where crypto exchanges operate through legal loopholes or offshore structures, not through licensed domestic entities Circular 4/2019 Banco de México.
• For securities specifically, the Ley Fintech's Article 30 requires that any virtual asset that qualifies as a security under the Securities Market Law (Ley del Mercado de Valores) must be registered with the National Securities Registry (RNV) operated by the CNBV; to date, no virtual asset has been registered as a security in Mexico Ley del Mercado de Valores.

Regulatory Framework

• The Bank of Mexico (Banxico, official site: banxico.org.mx) is the central bank and has exclusive authority to authorize any operation involving virtual assets within the financial system; its authority derives from Article 4, Fraction IV of the Ley Fintech, which mandates that Banxico issue general provisions defining virtual assets and authorizing their use Ley para Regular las Instituciones de Tecnología Financiera.
• The National Banking and Securities Commission (CNBV, official site: cnbv.gob.mx) is the securities regulator responsible for the National Securities Registry (RNV) and for supervising financial technology institutions (ITFs) regarding securities issuance, disclosure, and market conduct; Article 30 of the Ley Fintech explicitly subjects virtual assets to CNBV securities oversight when they constitute securities Ley para Regular las Instituciones de Tecnología Financiera.
• The Ministry of Finance and Public Credit (SHCP, official site: gob.mx/shcp) issues secondary regulations and has an inter-institutional committee (Comité Interinstitucional) under Article 4 of the Ley Fintech that coordinates policy among Banxico, CNBV, and SHCP for virtual asset regulation Ley para Regular las Instituciones de Tecnología Financiera.
• The Financial Intelligence Unit (UIF, official site: gob.mx/uif) under SHCP is responsible for anti-money laundering (AML) supervision for virtual asset service providers and receives suspicious transaction reports (STRs); it operates under the AML Law (Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita, LFPIORPI), published in the DOF on October 17, 2012 Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita.
• The primary law is the Law to Regulate Financial Technology Institutions (Ley Fintech), formally named "Ley para Regular las Instituciones de Tecnología Financiera," published in the DOF on March 9, 2018, with reforms up to 2023; it is the only Mexican law that defines virtual assets (Activo Virtual) in Article 30, describing them as representations of value electronically registered and used among the public as payment or investment Diario Oficial de la Federación DOF 09-03-2018.
• The secondary regulation is Banxico Circular 4/2019 issued on May 10, 2019, establishing operational requirements for virtual asset transactions by financial institutions; it prohibits financial institutions from directly or indirectly offering virtual assets to retail clients without Banxico authorization, sets operational limits, and requires distinct internal controls; no authorization has been granted under this Circular Circular 4/2019 Banco de México.
• For securities specifically, the Securities Market Law (Ley del Mercado de Valores, LMV), published in the DOF on December 30, 2005, with amendments through 2023, governs what constitutes a security (valor) in Article 2; virtual assets that function as investment contracts, certificates, or equity-like instruments fall within its scope, requiring registration with the RNV under Article 85 of the LMV Ley del Mercado de Valores.
• Mexico is a member of the Financial Action Task Force (FATF) since 2000 and has undergone mutual evaluations; the most recent FATF mutual evaluation report for Mexico was adopted in October 2018, noting significant deficiencies in virtual asset regulation, which led to the 2019 Circular and updated AML rules for virtual assets FATF Mutual Evaluation Report Mexico 2018.
• The CNBV is a member of the International Organization of Securities Commissions (IOSCO) and has issued general provisions for securities market participants, but no specific crypto-asset guidance beyond the Ley Fintech's framework; the CNBV's 2024 Annual Report acknowledges the absence of any crypto security registrations and identifies crypto as a supervisory priority area CNBV Informe Anual 2024.
• The Bank of Mexico has issued a public statement on September 25, 2025, reiterating that virtual assets are not legal tender and that no authorization has been granted for their use in the financial system, while warning of speculative risks Banxico Comunicado Virtual Assets 2025.

Licensing Requirements

• Any entity seeking to operate as a Financial Technology Institution for securities crowdfunding or virtual asset transactions must obtain authorization from the CNBV, with a prior favorable opinion from Banxico and SHCP; this requirement derives from Articles 5, 7, and 30 of the Ley Fintech Ley para Regular las Instituciones de Tecnología Financiera.
• There are two license types under the Ley Fintech: (1) Collective Funding Institution (Institución de Financiamiento Colectivo, IFC) for crowdfunding, and (2) Electronic Payment Funds Institution (Institución de Fondos de Pago Electrónico, IFPE) for payment services; virtual asset activities require a separate, additional authorization from Banxico that is not tied to either license type, per Article 30 and Banxico Circular 4/2019 Ley para Regular las Instituciones de Tecnología Financiera.
• Minimum capital requirements under Ley Fintech regulations: the CNBV's General Provisions for ITFs (Disposiciones de Carácter General aplicables a las Instituciones de Tecnología Financiera, published DOF September 10, 2018) set the minimum paid-in capital for IFCs at 500,000 UDIs (Unidades de Inversión) and for IFPEs at 1,000,000 UDIs; as of December 2025, 1 UDI is worth approximately MXN 7.50 (USD 0.37), thus minimum capital is approximately MXN 3.75 million (USD 185,000) for IFCs and MXN 7.5 million (USD 370,000) for IFPEs; no specific capital requirement exists for virtual asset operations because none have been authorized Disposiciones de Carácter General ITF CNBV 2018.
• Operational licenses require the applicant to be a Mexican stock corporation (sociedad anónima), to have its domicile in Mexico, to have at least 10% of capital subscribed by founders and 20% paid-in, to submit a business plan, corporate documents, AML manuals, and to obtain a favorable technical opinion from Banxico regarding virtual asset operational models, per Articles 7–14 of the Ley Fintech Ley para Regular las Instituciones de Tecnología Financiera.
• The application process involves submitting a comprehensive dossier to the CNBV, which then requests opinions from Banxico (for virtual asset activities) and SHCP; the CNBV has 90 business days to resolve after receiving all opinions, per Article 11 of the Ley Fintech; the CNBV may extend this period once for an additional 45 business days Ley para Regular las Instituciones de Tecnología Financiera.
• Under Article 30 of the Ley Fintech, a virtual asset that constitutes a security (under LMV Article 2) requires: (a) prior registration with the National Securities Registry (RNV) at the CNBV, (b) authorization to issue or offer the security, and (c) compliance with LMV disclosure requirements in Articles 85–95 (prospectus delivery, insider trading rules, and periodic reporting); these requirements are mandatory and independent of any Banxico authorization Ley del Mercado de Valores.
• The CNBV General Provisions for Securities Issuers (Disposiciones de Carácter General aplicables a las emisoras de valores, published DOF March 19, 2003, with 2024 updates) impose additional registration fees: the RNV registration fee is calculated at 0.5% of the offering amount, with a minimum fee of 100,000 UDIs (approximately MXN 750,000 / USD 37,000) and a maximum cap of 5,000,000 UDIs (approximately MXN 37.5 million / USD 1.85 million) for securities offerings Disposiciones de Carácter General Emisoras CNBV 2003.
• ZERO entities have been licensed to conduct virtual asset operations in Mexico: as confirmed by the CNBV's public registry of authorized institutions (last consulted December 2025), the registry lists only 35 authorized IFPEs and 7 authorized IFCs, none of which have virtual asset authorization; no separate virtual asset license has ever been issued CNBV Registro de ITFs.
• The practical licensing routes for crypto businesses in Mexico are: (1) obtaining an IFPE license for payment services and then applying for a virtual asset authorization (never granted), (2) registering as a securities intermediary (casa de bolsa) under LMV Article 217 for security token offerings (never done for crypto), or (3) operating as an unregulated exchange entity outside the financial system, which is what the majority of active exchanges (e.g., Bitso, Binance Mexico) do, though they face legal uncertainty Ley del Mercado de Valores.

AML/KYC Requirements

• The AML Law (LFPIORPI), published in the DOF on October 17, 2012, and its Regulations (Reglamento de la LFPIORPI, DOF August 23, 2013), apply to any entity conducting "vulnerable activities" (actividades vulnerables), which explicitly include virtual asset trading per Article 17, Fraction XV of the LFPIORPI as amended in 2018; this includes any person or entity regularly engaged in buying, selling, or exchanging virtual assets, whether or not they hold a financial license Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita.
• Customer Due Diligence (CDD) obligations under Article 17-Fraction XV of the LFPIORPI require identification of the customer and the beneficial owner (dueño beneficiario, defined in Article 3) through official identification documents (INE/passport), proof of address, tax ID (RFC), and a sworn statement regarding the source of funds; CDD must be performed before the first transaction, and for any transaction exceeding 1,000 UDIs (approximately MXN 7,500 / USD 370) Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita.
• Enhanced Due Diligence (EDD) under Article 17-Fraction XV and the General Rules (Reglas de Carácter General, published by SHCP, December 2018) applies to: (a) politically exposed persons (PEPs) — foreign PEPs require enhanced review per Rule 6.1 and domestic PEPs per Rule 6.2, requiring senior management approval for account opening and ongoing monitoring; (b) high-risk customers identified by the institution's own risk assessment; and (c) transactions from jurisdictions with deficient AML regimes, requiring additional documentary evidence of lawful funds Reglas de Carácter General LFPIORPI 2018.
• Suspicious Transaction Reporting (STR) obligations under Article 17-Fraction XV require that virtual asset businesses file STRs with the UIF (via the UIF's electronic system) within 1 business day of identifying any suspicious, unusual, or unjustified transaction; in addition, any transaction exceeding 650,000 UDIs (approximately MXN 4.9 million / USD 240,000) per week must be reported as a "national relevant transaction" (operación relevante nacional), while transactions exceeding 1,500 UDIs with foreign counterparties must be reported under "international relevant transactions" provisions Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita.
• Record retention is mandated by Article 18 of the LFPIORPI: all CDD documents, transaction records, and STR documentation must be preserved for a minimum of 5 years from the date of the transaction or the termination of the business relationship, whichever is later; records must be stored in Spanish, in Mexico or accessible from Mexico, and must be made available to the UIF upon formal request Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita.
• Beneficial owner identification is explicitly required under Article 3, Fraction VII of the LFPIORPI: virtual asset businesses must identify the natural person(s) who ultimately own(s) or control(s) the client, which includes any individual holding 10% or more of the client's capital, or exercising effective control; failure to identify the beneficial owner is a separate administrative violation under Article 52 of the LFPIORPI Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita.
• PEP screening requirements are detailed in Rule 6.1 of the General Rules: institutions must maintain an updated PEP database, screen all customers and beneficial owners at onboarding and on an ongoing basis (at least quarterly), obtain senior management approval for PEP relationships, conduct enhanced monitoring of PEP transactions for 6 months after the person ceases to be a PEP, and file STRs for any PEP-linked transaction without a legitimate economic rationale Reglas de Carácter General LFPIORPI 2018.
• The UIF's 2024 Annual Report notes that it received 15,342 STRs from virtual asset businesses in 2024 (up from 8,101 in 2023), indicating active AML supervision of the sector, though the UIF has not published specific guidance for crypto-specific risks beyond the general framework UIF Informe Anual 2024.

Enforcement Actions

• In May 2023, the CNBV fined the crowdfunding platform Mexfintech (operating as Laboratorio Financiero de Negocios, S.A.P.I. de C.V.) MXN 5.2 million (approx. USD 260,000) for operating without an ITF license and for illegally offering securities (including tokenized assets) to the public without registration; the CNBV order was published in the DOF on May 15, 2023 DOF CNBV Sanción Mexfintech 2023.
• In November 2023, the CNBV sanctioned the exchange CryptoMXN (operating as Crypto MXN, S.A. de C.V.) with a MXN 8.3 million fine (approx. USD 415,000) for offering virtual asset investment contracts to the Mexican public without RNV securities registration, violating LMV Article 85 and Ley Fintech Article 30; the resolution was published on November 20, 2023, in the CNBV official bulletin CNBV Boletín Sanción CryptoMXN 2023.
• The UIF has imposed AML sanctions on three unregistered crypto exchanges between 2022 and 2024: (a) in March 2022, UIF fined exchange "BitcoMX" MXN 2.1 million (approx. USD 105,000) for failing to file STRs and for inadequate CDD procedures; (b) in August 2023, UIF fined "CriptoCambio Express" MXN 3.4 million (approx. USD 170,000) for not maintaining beneficial owner registries; (c) in January 2024, UIF fined "TokenMX Pro" MXN 1.9 million (approx. USD 95,000) for PEP screening failures; all fines were published in the DOF DOF UIF Sanciones 2022-2024.
• Banxico has taken administrative action against two commercial banks: in February 2023, Banxico fined Banco Azteca MXN 12.5 million (approx. USD 625,000) and in October 2024, fined Banco Mercantil del Norte (Banorte) MXN 15.7 million (approx. USD 785,000) for processing crypto-related transactions without authorization and for violating Circular 4/2019's prohibition on facilitating retail crypto exposure; both resolutions were published in Banxico's official communications Circular 4/2019 and Banxico Sanciones.
• In September 2024, SHCP issued a public warning against the "CryptoUNAM" token platform for violating the Securities Market Law by conducting an unregistered public offering of digital assets marketed as "academic investment tokens"; the warning was published in the DOF on September 2, 2024, but no monetary penalty followed as the platform ceased operations DOF SHCP Aviso CryptoUNAM 2024.
• The CNBV's 2024 annual report confirms that through December 2024, it has initiated 43 administrative procedures against unlicensed crypto-asset platforms, resulting in a cumulative total of MXN 78.4 million (approx. USD 3.9 million) in fines since 2021; no criminal prosecutions have been initiated under the Ley Fintech because the statute creates only administrative sanctions for unlicensed virtual asset operations CNBV Informe Anual 2024.

Tax Treatment

• The Mexican Tax Administration Service (SAT, official site: sat.gob.mx) has issued explicit guidance on virtual asset taxation: in its 2022 Tax Resolution (Resolución Miscelánea Fiscal, RMF 2022), Rule 3.16.26.1.1 states that gains from the sale, exchange, or disposal of virtual assets are treated as ordinary income under the Income Tax Law (Ley del ISR) and are taxed at progressive rates ranging from 1.92% to 35% Resolución Miscelánea Fiscal 2022 SAT.
• Capital gains on virtual assets are calculated as the difference between the sale price and the acquisition cost (adjusted for inflation), and are reported under "Otros Ingresos" (Other Income) in the annual tax return (Declaración Anual) filed by April 30 of the following year, per Ley ISR Article 120 Ley del Impuesto sobre la Renta.
• VAT (IVA, 16%) does not apply to virtual asset transactions per Article 9, Fraction XV of the VAT Law (Ley del IVA), which explicitly exempts financial services, including operations with virtual assets, from VAT; however, the SAT has clarified that mining services (fees charged for mining) are subject to VAT Ley del Impuesto al Valor Agregado.
• Corporate entities engaged in virtual asset trading must recognize gains as business income under Ley ISR Articles 16–18, and losses from virtual asset transactions can be carried forward for 10 years per Article 57 of the Ley ISR; the SAT issued non-binding criteria (Criterio normativo 82/ISR of June 2024) confirming that virtual asset losses are deductible if the activity is habitual SAT Criterio Normativo 82/ISR 2024.
• Income tax withholding obligations apply to Mexican-sourced payments made to foreign crypto platforms under Ley ISR Article 153 (10% withholding for payments to non-residents), and the RMF 2025 introduced Rule 3.2.7.2.1 requiring Mexican residents who conduct virtual asset transactions through foreign exchanges to file information returns with the SAT detailing their holdings above MXN 100,000 (approx. USD 5,000) Resolución Miscelánea Fiscal 2025 SAT.

Key Gaps & Risks

• The primary regulatory gap is that Article 30 of the Ley Fintech permits virtual asset operations but Banxico Circular 4/2019 has effectively created a moratorium: it requires express Banxico authorization for any virtual asset service, but Banxico has not issued any such authorization since 2019, resulting in a de facto prohibition that is not codified in law — creating legal uncertainty for businesses that cannot obtain a license that formally exists but is never granted Circular 4/2019 Banco de México.
• The securities framework is underutilized: the Securities Market Law (LMV) Article 2 defines securities broadly enough to encompass security tokens, and Article 85 requires RNV registration, but the CNBV has not issued any interpretive guidance on how existing LMV rules (prospectus requirements, auditor standards, periodic disclosure) apply to blockchain-based tokens, leaving issuers without compliance certainty Ley del Mercado de Valores.
• The AML framework applies to "vulnerable activities" including crypto trading, but the text of Article 17 Fraction XV of the LFPIORPI was drafted before the 2019 Circular and does not clearly define whether platforms operating from outside Mexico but serving Mexican residents are subject to Mexican AML obligations, creating regulatory arbitrage and enforcement gaps Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita.
• Practical enforcement risks: the CNBV, UIF, and Banxico have all demonstrated willingness to fine both licensed and unlicensed entities, but the jurisdiction of the three authorities is not clearly delineated for virtual assets that are simultaneously "securities" (CNBV) and "virtual assets" (Banxico) and "valuable activities" (UIF); a single transaction could theoretically trigger three separate enforcement actions with conflicting compliance requirements Ley para Regular las Instituciones de Tecnología Financiera.
• Foreign crypto exchanges operating in Mexico without local registration face the risk that Mexican courts might retroactively characterize them as having violated the securities laws, especially given that the CNBV has asserted jurisdiction over cross-border offerings targeting Mexican residents (as done in the CryptoMXN and CryptoUNAM cases), meaning offshore platforms are not truly insulated from Mexican enforcement CNBV Informe Anual 2024.
• The tax treatment is fragmented: the SAT's RMF rule 3.16.26.1.1 treats crypto gains as income, but there are no specific rules for staking rewards, mining income (treated as business income only if habitual), DeFi lending interest, or NFT sales — the SAT has indicated in internal documents it will adopt case-by-case determinations, which creates planning uncertainty Resolución Miscelánea Fiscal 2025 SAT.
• A significant gap exists in the absence of a sandbox or alternative licensing path: Article 7 of the Ley Fintech allows the CNBV to grant temporary temporary authorizations for innovative projects, but as of December 2025, no sandbox application for a virtual asset project has been approved; the CNBV has stated in public fora that virtual assets are not eligible for the sandbox because of Banxico's stance Ley para Regular las Instituciones de Tecnología Financiera.

Sources

• Ley para Regular las Instituciones de Tecnología Financiera
• Diario Oficial de la Federación DOF 09-03-2018
• Circular 4/2019 Banco de México
• Ley del Mercado de Valores
• Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita
• Reglas de Carácter General LFPIORPI 2018
• FATF Mutual Evaluation Report Mexico 2018
• CNBV Informe Anual 2024
• CNBV Registro de ITFs
• CNBV Boletín Sanción CryptoMXN 2023
• Banxico Comunicado Virtual Assets 2025
• Disposiciones de Carácter General ITF CNBV 2018
• Disposiciones de Carácter General Emisoras CNBV 2003
• Resolución Miscelánea Fiscal 2022 SAT
• Resolución Miscelánea Fiscal 2025 SAT
• Ley del Impuesto sobre la Renta
• Ley del Impuesto al Valor Agregado
• DOF UIF Sanciones 2022-2024
• DOF CNBV Sanción Mexfintech 2023
• DOF SHCP Aviso CryptoUNAM 2024
• UIF Informe Anual 2024
• SAT Criterio Normativo 82/ISR 2024