Mexico DOF updates rules for financial groups
The official gazette updated rules for holding companies and sub-holdings. El Economista also reported eight cyber incidents in Mexico from January to May.
Mexico's Official Gazette published a resolution amending the rules for controlling companies in financial groups and sub-holdings in matters shared by the national supervisory commissions. The rule took effect the day after publication, while cyber incident reports continued to appear in Mexico's financial sector during 2026.
Mexico's Official Gazette published a resolution amending the rules that apply to controlling companies in financial groups and to sub-holdings in areas overseen jointly by the national supervisory commissions. The resolution took effect the day after publication, while El Economista reported eight incidents filed with Banco de México or the National Banking and Securities Commission between January and May 2026.
What changed in the resolution published in the DOF?
The resolution updates the general rules applicable to controlling companies in financial groups and to sub-holdings in areas shared by the national supervisory commissions. The document was published in the Official Gazette on October 28, 2026, and set its effective date for the following day.
What do the incidents reported in Mexico during 2026 show?
Records reported to Banco de México or the CNBV accounted for eight cases between January and May 2026, according to El Economista. The outlet also said none of those records attributed the incidents to the group called CyberCartel.
In the same report, El Economista said Straiker found 43 credentials from a fintech that could help enable improper activity tied to SPEI. The material provided does not show a breach of Banxico's core infrastructure or publish an amount stolen through test transactions, so that point remains a finding attributed to the source, not a confirmed intrusion.
Which incident caused the largest financial impact?
The incident with the largest confirmed financial impact involved a bank hit in February 2026 with Qilin ransomware, according to the same El Economista report. The recognized loss was 91.76 million pesos, and transfer services were affected.
The outlet also said the amounts determined for Mexican financial institutions in 2026 totaled 125.63 million pesos. At the same time, four incidents were still awaiting financial assessment, and the impact on customers of a popular finance company attacked in April was still undetermined.
Sources
- RESOLUCIÓN que modifica las Disposiciones de carácter general aplicables a las sociedades controladoras de grupos financieros y subcontroladoras que regulan las materias que corresponden de manera conjunta a las Comisiones Nacionales Supervisorasdof.gob.mx· Diario Oficial de la Federación
- When Cybersecurity Fails, Legal Responsibility Beginsmexicobusiness.news· Mexico Business News
- CyberCartel utilizó IA para atacar más de 400 objetivos financieros en América Latinaeleconomista.com.mx· El Economista
