Argentina and Mexico tighten anti-fraud rules

Update September 15, 2026: BCRA Communication A 8473/2026 was clarified in the official text, which bans decisions based solely on the fraud score and specifies that deadlines start from publication and from delivery of technical documentation. In Mexico, changes were also added on SMS authentication and deadlines to adapt apps and SPEI transfers.

Argentina now has mandatory rules to prevent and mitigate fraud in electronic funds transfers for financial institutions, payment service providers that offer payment accounts, and administrators of instant transfer schemes. Communication A 8473/2026 from the Central Bank of the Argentine Republic adds a risk assessment based on a fraud score linked to the CUIL/CUIT, which banks and payment-account providers must use.

What does the new BCRA rule require?

The BCRA requires the fraud risk score to be incorporated into customer onboarding, daily transaction monitoring, and the review of account-holder registries, but the official text makes clear that decisions cannot be based solely on that score. According to iProUP and the Official Gazette, the framework covers both senders and recipients of transfers, and will be used to recategorize risk levels within control processes.

Communication A 8473/2026 also sets staggered deadlines. Administrators of instant transfer payment schemes have 120 calendar days from publication to adapt their infrastructure. Financial institutions and PSPCPs have 60 days to add the indicator to customer onboarding and registry review, and 90 days to integrate it into daily transaction monitoring, counted from receipt of the administrators' technical documentation, according to El Destape, iProUP, and the Official Gazette.

In addition, the technical analysis released by The Metal Vortex says the scores will be distributed through monthly files and an API for participating institutions. That same material says the score will be used in onboarding, transaction monitoring, and periodic customer reviews, always with controls that prevent automated decisions based only on that indicator.

How does this compare with Mexico?

In Mexico, the CNBV's Single Banking Circular already sets information security obligations for credit institutions, including an internal control system designed to protect the confidentiality, integrity, and availability of information. That framework also requires appointing an information security officer, or CISO, named by the CEO and reporting directly to him.

Mexican rules also establish a chain of notices after incidents. According to Grupo ACMS Consultores, notification to the commission must be immediate, followed by a detailed incident report within 5 business days, a corrective action plan within 15 business days, and notice to customers within 48 hours when sensitive information is compromised.

Since September 2, 2026, the CNBV has also allowed SMS-delivered codes as a category 3 authentication factor for certain digital financial services carried out through technology-based commission agents, according to iworld.com.mx. That easing sits alongside other security requirements already in force in Mexican banking.

What deadline did Banxico set for apps and SPEI?

Banxico reportedly set December 14, 2026 as the deadline to adjust banking apps and mobile transfers in SPEI, with reference to possible administrative penalties for noncompliance, according to Ruptura 360. Other coverage places that same date as the end of the transition period to standardize how app-based transfers work.

That reference matches reporting by The Rio Times and ClearingPost, which attribute to circulars 9/2026 and 10/2026 the requirement to standardize transfers in apps before December 14, 2026. Those reports cite a 180-day transition period from the effective date and say the adjustment affects banks and SPEI participants, including CoDi and DiMo flows.

What new regulatory front is under discussion in Mexico?

At the same time, Mexico is debating a proposed rule to combat hidden charges and deceptive practices at banks and fintechs. If approved, Condusef, the Bank of Mexico, and the CNBV would have 180 calendar days to issue secondary regulation, and financial institutions would then have another 180 days to adapt their digital platforms, according to El Cronista.