Mexico: CNBV and Banxico tighten controls

The CNBV said 977 people took part in its second 2026 evaluation for certification in anti-money laundering and counterterrorist financing. At the same time, several reports attribute new cybersecurity and SPEI operating changes to Banxico and the CNBV, although those requirements still need to be verified in the official publication.

What did the CNBV confirm?

The CNBV said it carried out the second 2026 evaluation for certification in anti-money laundering and counterterrorist financing, with 977 participants. The agency released the figure on October 24, 2026.

That official notice is, for now, the only fully confirmed point in the materials reviewed. The rest of the developments circulating around Mexico's financial system are attributed to third parties, not to the original regulatory text.

What changes are being attributed to Banxico and the CNBV?

An analysis by Safeguard.sh attributes to the CNBV and Banxico requirements that would include immediate incident notification, two independent penetration tests per year for banks, submission of findings to the CNBV within 20 business days, and remediation plans within 10 business days. The source itself makes clear that this is not the official regulatory text.

The same material suggests those obligations would be part of a broader financial security framework, but that interpretation should be treated as preliminary until the official version appears. For that reason, the deadlines and compliance mechanics cannot be presented as final based on the information available.

What was said about SPEI and mobile transfers?

Syswork México reported that Banxico's Circular 9/2026 would change SPEI rules and set December 14, 2026 as the deadline for banks and fintechs to standardize SPEI transfers from mobile devices. That claim also remains pending verification in the official publication.

Along the same lines, other outlets cited in the material, including El Informador and Diario del Yaqui, published notes about changes to bank transfers from cellphones, but the information package does not include the regulatory text needed to confirm the exact scope of those changes.

What operational impact do the sources describe?

El Economista reported that the group known as CyberCartel would have used artificial intelligence to coordinate attacks against more than 400 financial targets in Latin America, although it clarified that figure does not equal successful intrusions and that the affected organizations remain unnamed. The outlet also said eight incidents were recorded in Mexico between January and May 2026, compared with four in 2025.

According to the same report, the confirmed damages reached 125.63 million pesos, while four cases were still awaiting economic assessment. The note added that none of the episodes was attributed to the CyberCartel group.

El Economista also attributed to Straiker researchers the discovery of 43 credentials belonging to a fintech company. According to the report, that material could enable improper activity linked to SPEI, but it did not show a breach of Banxico's core infrastructure or quantify illicit transactions.