If you’ve been searching for clear answers on how Mexico handles crypto, you’ve landed in the right spot. Mexico crypto regulations revolve around a three‑player system, and the National Banking and Securities Commission, or CNBV the regulator that licenses and monitors financial institutions dealing with virtual assets, sits at the center of the monitoring puzzle.

Why Mexico’s Crypto Framework Looks Different

Mexico introduced its Fintech Law in 2018, officially naming “virtual assets” as electronic representations of value used for payments. This law created a dedicated legal category for crypto and forced every crypto‑related service provider to fit inside a regulated gray zone. The result? A split of duties between three authorities:

• CNBV - licensing and ongoing supervision.
• Banco de México (Banxico) - sets the operational limits for crypto services (Rule 4/2019).
• Ministry of Finance and Public Credit (SHCP) - tax policy and fiscal compliance.

This triangle keeps consumer protection, financial stability, and tax collection in check while still allowing crypto activity.

CNBV’s Licensing Mandate

Under the Fintech Law, any fintech that wants to offer services involving virtual assets must obtain a license from CNBV. The application process demands:

1. Proof of robust AML/CTF policies.
2. Capital adequacy that matches the risk profile of crypto operations.
3. Technical architecture that can securely store and transmit digital tokens.
4. Transparent corporate governance and a clear ownership structure.

If the commission finds gaps, it can reject the request or ask for remedial measures before granting approval.

Monitoring, Reporting, and AML Obligations

Once licensed, an institution falls under continuous supervision. CNBV focuses heavily on anti‑money‑laundering rules:

• Customer due‑diligence (CDD) must be performed for every new user, with enhanced checks for politically exposed persons.
• Transactions over MXN600,000 (about US$30,000) trigger mandatory filing to Mexico’s Financial Intelligence Unit (FIU) the agency that receives suspicious‑activity reports.
• Quarterly activity reports are required, detailing volume, counterparties, and risk‑assessment outcomes.

Failure to comply can result in fines, suspension of the license, or outright revocation.

Banxico’s Rule 4/2019 and Its Practical Impact

Even with a CNBV license, a fintech cannot simply start offering custody, exchange, or transmission services. Banxico’s Rule 4/2019 reserves those activities for institutions that receive explicit authorisation from the central bank. As of October 2025, no fintech has been granted such permission, meaning most CNBV‑licensed entities can only provide limited services, such as:

• Advisory or educational platforms about crypto.
• On‑ramp/off‑ramp services that partner with non‑regulated exchanges.
• Token‑management tools that do not hold custody of user assets.

This creates a “regulated gray area” where crypto is legal for individuals but heavily constrained for financial institutions.

Digital Agents - A New Licensing Category (2024‑2025)

July 2024 saw the introduction of “Digital Agents.” These are specialized banking entities that can offer digital‑asset services to the public, but they must obtain a separate digital‑agent license from CNBV. Key features include:

1. Permission to hold crypto custody on behalf of clients.
2. Obligation to integrate Banxico’s real‑time transaction monitoring APIs.
3. Higher capital buffers (minimum MXN150million) compared to regular fintechs.

Bitso, Mexico’s leading exchange, applied for a digital‑agent license in early 2024 and has been actively shaping the regulatory guidelines through its dialogue with CNBV.

Tax Compliance - What CNBV‑Supervised Firms Must Track

SHCP treats crypto gains as income from the sale of goods. The tax rates are:

• Individuals - up to 35% marginal tax.
• Legal entities - flat 30% corporate tax.

Additional obligations include:

1. VAT (16%) on services paid for with crypto, if the service falls under taxable categories.
2. Withholding tax of 20% on purchases above US$12,500, which the buyer must remit directly to tax authorities.
3. Annual reporting of crypto‑related income on the “Declaración Anual” filing.

CNBV coordinates with the tax agency to ensure that licensed institutions flag high‑value transactions and submit the required tax information.

Looking Ahead - CBDC and Potential Regulatory Shifts

Banxico is set to launch a digital peso (CBDC) by the end of 2025. This will likely expand CNBV’s supervisory duties, as financial institutions that interact with the CBDC will need to meet both central‑bank and CNBV standards. Anticipated changes include:

• New reporting fields for CBDC‑related balances.
• Cross‑border transaction monitoring aligned with international crypto standards.
• Possible relaxation of Rule 4/2019 for licensed digital agents, enabling them to provide full‑service crypto custody.

Stakeholders should prepare now by upgrading compliance platforms and training staff on CBDC‑specific risk controls.

Practical Checklist for Fintechs Looking to Operate in Mexico

• Secure a CNBV license - gather AML policies, capital proof, and technical security documentation.
• Confirm whether you need a Digital Agent license - assess if you require custody services.
• Implement real‑time transaction monitoring that feeds into Banxico’s API (required for Rule 4/2019 compliance).
• Set up automatic filing to the FIU for transactions exceeding MXN600,000.
• Integrate tax‑calculation modules that apply 30‑35% income tax and 16% VAT where appropriate.
• Prepare for CBDC reporting - map out data fields and internal controls now.

Following this list will help you stay on the right side of CNBV’s monitoring regime and avoid costly sanctions.

Comparison of Mexico’s Crypto Regulatory Bodies

Frequently Asked Questions