Mexico tightens controls on SPEI

Mexico added a series of measures and rulings in September that tighten controls on electronic payments, customer identification and fraud prevention. Banxico reiterated that it never asks for personal or financial information through calls, messages, emails or social media. At the same time, changes are moving forward for SPEI and payment networks, and the Supreme Court upheld fines tied to identification failures in vulnerable activities.

What changed in SPEI and payment networks?

Banxico and the CNBV pushed forward new 2026 rules for SPEI and for payment networks that aim to standardize transfers, strengthen validation and adjust the operations of payment aggregators. In parallel, the financial sector discussed rules that would require merchants to receive authorized funds the same day, keep separate accounts, and limit subaggregation.

An analysis published by El Economista said the joint draft of new General Provisions applicable to Payment Networks and the rules for Clearing Houses for card payments includes additional obligations for payment aggregators. Those include same-day settlement, separate bank accounts for merchant funds, a ban on subaggregation and fee caps that will pressure intermediary margins.

FinTech Mexico welcomed the public consultation on those drafts and said they point to a more competitive and transparent payments ecosystem for non-bank participants. El Cronista, meanwhile, said the new rules for payment networks also include changes to interchange fees.

What adjustments did Banxico make to transfers?

Banxico updated in 2026 rules linked to Circulars 3/2012 and 14/2017 to organize the mobile transfer experience between financial institutions and expand the operating limits for simplified accounts. Ruptura360 added that the new SPEI rules strengthen beneficiary data validation and user confirmation messages, in line with measures meant to reduce fraud in electronic transactions.

Pagoralia said those changes arrive amid a rise in cybersecurity incidents and fraud, and that standardization is intended to make mobile transfers work more uniformly across institutions. Banxico also issued an institutional message reminding the public that it does not request personal or financial data through unofficial channels and urging users to verify the source before responding to suspicious requests.

What did the SCJN say about identification fines?

The Supreme Court upheld the validity of fines for failing to meet identification requirements in vulnerable activities under the LFPIORPI, when it ruled on amparo en revisión 6853/2025. According to El Cronista's coverage, the ruling reaffirms the obligation to request properly signed certificates within identification processes.

The decision ratifies sanctions imposed by Mexican authorities for not complying with those requirements. In parallel, an opinion piece published by Excélsior mentioned that the CNBV imposed 53 sanctions on three financial institutions for more than 185 million pesos, linked to compliance failures, although that reference appears in the source material as an opinion item and not as an official confirmation.

How do these measures connect to user control?

Mandatory registration of mobile lines with CURP expands user traceability and overlaps with the management of digital financial services. The guidelines published on December 9, 2025, amended the Federal Telecommunications and Broadcasting Law, and mandatory registration has been in effect for all users since January 9, 2026.

Milenio reported that more than 9.5 million lines ending in the digit 1 were successfully linked in the first deadline, and that the following deadlines run by the last digit of the phone number through December 2026. Heraldo de México added that lines not linked on time can be suspended within 72 hours, and that carriers handle the process using a current official ID and CURP for individuals.

MSN Noticias México also published an analysis arguing that the requirement makes it easier for debt collection firms and financial institutions to track users while managing debts. On another front, Ámbito reported that the SAT said it immobilized 15,968 accounts between September 2025 and June 2026, along with 147 administrative orders that led to 1,508 people being added to the Blocked Persons List.