Mexico’s crypto market is projected to hit USD 985.5million in 2025, but that growth comes with a maze of rules that can trip up even seasoned fintech firms. At the heart of this maze is the National Banking and Securities Commission (CNBV) Mexico’s main supervisor for financial institutions dealing with virtual assets. If you’re looking to launch a crypto service, understand how CNBV monitors, licenses, and enforces compliance - or you’ll find your project stalled before it even starts.

Who’s Who in Mexico’s Crypto Oversight?

The regulatory landscape is split among three powerful bodies:

• Banco de México (Banxico) the country’s central bank, responsible for monetary policy and the technical rules governing crypto transactions
• Ministry of Finance and Public Credit (SHCP) the fiscal authority that sets tax policy for virtual‑asset activities
• National Banking and Securities Commission (CNBV) the licensing and supervisory agency for fintechs and banks that want to handle crypto

Each agency has a clear‑cut role, but they also coordinate closely to keep the ecosystem stable and protect consumers.

CNBV’s Licensing Power Under the 2018 Fintech Law

The Fintech Law Mexico’s 2018 legislation that introduced the legal concept of virtual assets defines a virtual asset as an electronic representation of value used for payments that can only be transferred electronically. Under this law, any financial‑technology firm that wants to offer crypto‑related services must first obtain a license from CNBV.

Key licensing requirements include:

1. Proof of robust internal controls and risk‑management frameworks.
2. Demonstrated AML/CTF procedures that meet the standards of Mexico’s Financial Intelligence Unit (UIF) the agency that receives suspicious activity reports for crypto transactions.
3. Capital adequacy thresholds that vary by the type of crypto service offered (custody, exchange, transmission).

Once licensed, firms fall under CNBV’s continuous supervision - a process that includes regular reporting, on‑site examinations, and real‑time transaction monitoring.

Monitoring and AML Compliance: What CNBV Looks For

CNBV’s monitoring program zeroes in on two areas:

• Anti‑money‑laundering (AML) compliance. Institutions must perform customer due‑diligence (CDD) checks, keep records of all crypto transactions, and file reports for any move above the thresholds set by the UIF (generally USD12,500).
• Consumer‑protection safeguards. This includes transparent fee structures, clear risk disclosures, and mechanisms for handling complaints.

Failure to meet these obligations can trigger fines, license suspension, or outright revocation - powers that CNBV has exercised on several fintechs that fell short on AML reporting.

Banxico’s Rule4/2019: The Missing Piece

Even with a CNBV license, a fintech can’t automatically offer crypto services. Banxico’s Rule4/2019 a regulation that bars banks and licensed fintechs from providing direct crypto custody, exchange, or transmission services without explicit approval.

As of 2025, Banxico has not granted any such approvals, effectively meaning that CNBV‑licensed entities can only operate in a limited, ancillary capacity - for example, providing advisory services or linking users to external exchanges that are not supervised by Banxico.

This split creates a “regulated gray area”: crypto is legal for individuals and non‑financial entities, but financial institutions face a de‑facto prohibition on core crypto activities.

Digital Agents: A New License Category (2024)

To bridge the gap, the CNBV introduced the concept of Digital Agents specialized banking entities designed to offer digital‑asset services to the public in July2024. These agents receive a distinct license that explicitly allows them to provide custody and exchange services, but they remain subject to both CNBV supervision and Banxico’s technical rules.

Major players like Bitso Mexico’s leading cryptocurrency exchange, actively engaged in shaping the regulatory framework have applied for Digital Agent status, signaling a potential shift toward a more permissive environment.

Taxation and Reporting Obligations

CNBV also works with the Tax Administration Service (SAT) Mexico’s tax authority responsible for collecting income tax, VAT, and withholding on crypto transactions to ensure that profits from crypto sales are reported correctly.

Key tax rules:

• Individuals pay up to 35% income tax on crypto gains; legal entities face a 30% rate.
• Transactions over USD12,500 trigger a 20% withholding that must be paid directly to SAT.
• Value‑added tax (16%) applies to goods or services bought with cryptocurrency, depending on classification.

Financial institutions must embed these tax calculations into their reporting pipelines and submit detailed statements to SAT via CNBV’s monitoring platform.

Future Outlook: Peso Digital and Expanded CNBV Role

By the end of 2025, Banxico expects to launch a central‑bank digital currency (CBDC) - the peso digital a government‑issued digital version of the Mexican peso, aimed at improving financial inclusion and payment efficiency. The introduction of a CBDC will demand even tighter coordination between Banxico and CNBV.

CNBV will likely expand its supervision to cover:

1. Interoperability between private crypto services and the peso digital.
2. Enhanced consumer‑protection frameworks for CBDC wallets.
3. Joint AML/CTF oversight for transactions that cross the private‑public digital‑currency boundary.

For fintechs, this means preparing now - building compliant AML systems, documenting risk controls, and staying in close contact with both CNBV and Banxico.

Practical Checklist for Fintechs Entering the Mexican Crypto Space

1. Secure a CNBV license. Submit a detailed business plan, AML policy, and capital proof.
2. Confirm Banxico approval. If you plan to offer custody or exchange services, apply for an exception under Rule4/2019 or aim for Digital Agent status.
3. Implement robust AML/CTF controls. Integrate transaction monitoring software that flags transfers above USD12,500 and generates UIF reports automatically.
4. Align tax reporting. Build in calculations for income tax, VAT, and the 20% withholding; file quarterly statements with SAT through CNBV’s portal.
5. Prepare for peso digital. Design APIs that can handle both private crypto tokens and the upcoming CBDC to stay future‑proof.
6. Maintain ongoing compliance. Schedule regular internal audits, update risk assessments, and stay tuned to CNBV circulars.

Following this list won’t guarantee a smooth ride, but it’ll keep you on the right side of the regulator and away from costly penalties.

Comparison of Licensing & Supervision Roles

Next Steps for Stakeholders

For existing fintechs: Conduct a gap analysis against the checklist above, file any pending CNBV applications, and start building a liaison team with Banxico.

For investors: Look for companies that have already secured Digital Agent status - they’re positioned to capitalize on the soon‑to‑launch peso digital.

For regulators: Keep an eye on the evolving CBDC framework and consider issuing interim guidance that clarifies the interaction between Rule4/2019 and Digital Agent licenses.