Mexico: technology regulation at a glance

Framework: Ley para Regular las Instituciones de Tecnología Financiera (Fintech Law, 2018); Banxico Circular 4/2019 on Virtual Assets; Federal Anti-Money Laundering Law (LFPIORPI); Securities Market Law (LMV); Income Tax Law administered by SAT. Authorities: Banco de México (Banxico), CNBV, SHCP, SAT.

Crypto is legal to hold and trade in Mexico but there is no dedicated comprehensive crypto/VASP licensing regime. The 2018 Fintech Law defines 'virtual assets' and states they are not legal tender; Banxico Circular 4/2019 largely forecloses banks and Fintech Institutions from offering crypto services to the public. Non-financial exchanges operate legally, regulated only for AML/KYC as DNFBPs, while a broader 'Fintech Law 2.0' overhaul (crypto, stablecoins, open finance) is under active discussion in 2026 but not yet enacted.

Framework: No comprehensive AI statute. Binding AI-specific rules exist in particular sectors, chiefly the reforms to the Federal Labor Law (Ley Federal del Trabajo) and Federal Copyright Law (Ley Federal del Derecho de Autor) on performers' voice/image (published in the DOF on 14 May 2026), alongside existing data-protection law. A comprehensive 'Ley Nacional para Regular el Uso de la Inteligencia Artificial' and a constitutional amendment to empower Congress on AI are only proposed.

Mexico currently regulates AI through sector-specific measures rather than a single comprehensive statute. As of May 2026, enacted reforms protect performers' voice and image against AI cloning, while a comprehensive national AI law, a constitutional amendment, and an AI-dubbing ban in cinema remain pending or only partially approved. A multi-stakeholder National AI Agenda 2024-2030 exists as a proposal, not a binding government strategy.

Framework: Federal Law on the Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP), published in the Diario Oficial de la Federación on 20 March 2025; complemented by the General Law on Protection of Personal Data Held by Obligated Subjects (LGPDPPSO) for the public sector. Supervisory authority: Secretariat of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno).

Mexico maintains a comprehensive, GDPR-style data-protection regime grounded in the constitutional rights to privacy and informational self-determination. A wholly new LFPDPPP for the private sector took effect on 21 March 2025, repealing the 2010 law, alongside a reformed General Law (LGPDPPSO) for public-sector entities. The 2024-2025 constitutional reform abolished the independent regulator INAI and transferred data-protection oversight to the executive's Secretariat of Anti-Corruption and Good Governance.

Framework: Ley para Regular las Instituciones de Tecnología Financiera ('Ley Fintech', published 9 March 2018), implemented via secondary regulations issued by the CNBV, Banco de México (Banxico) and SHCP. The CNBV authorizes Financial Technology Institutions (ITF), with Banxico operating the payment rails.

Mexico has a clear, dedicated fintech licensing regime. The 2018 Fintech Law created two authorized institution types, Electronic Payment Funds Institutions (IFPE / e-money) and crowdfunding institutions, both requiring CNBV authorization with the favorable opinion of Banxico and the Finance Ministry (SHCP). Instant-payment infrastructure (SPEI, CoDi, DiMo) is operated by Banxico, while open finance and BNPL remain only partially regulated, with open-banking secondary rules years overdue.

Framework: Ley de Migración (2011) and its Reglamento, administered by the Instituto Nacional de Migración (INM) and Mexican consulates under the Secretaría de Relaciones Exteriores (SRE). No dedicated digital-nomad statute exists; remote workers use the standard Temporary Resident Visa (Residente Temporal).

Mexico has no dedicated digital-nomad or remote-work visa, but it offers a well-established and widely used pathway: the Temporary Resident Visa granted on the basis of 'economic solvency' (proof of income or savings). Remote workers earning foreign-sourced income qualify through this route, applying at a Mexican consulate abroad before exchanging the visa for a residence card at INM. Short stays (up to 180 days) are possible on a visitor permit (FMM) without a Mexican work authorization.

Framework: No single comprehensive online-safety statute. The regime is a patchwork: the new Ley en Materia de Telecomunicaciones y Radiodifusión (published in the Diario Oficial de la Federación on 16 July 2025, in force 17 July 2025); intermediary/platform liability via USMCA-driven 'notice-and-takedown' safe harbors in the Ley Federal del Derecho de Autor (2020); and child-protection provisions in the Ley General de los Derechos de Niñas, Niños y Adolescentes (LGDNNA).

Mexico has no comprehensive online-safety law equivalent to the EU DSA or UK OSA, nor does it impose heavy state censorship of the internet. Online content and platforms are governed by a fragmented mix of the 2025 Telecommunications and Broadcasting Law (which defines and partially regulates 'digital platforms'), USMCA-derived copyright safe harbors with notice-and-takedown, and sectoral child-protection rules. A controversial 2025 proposal to let the regulator block platforms without a court order was removed after free-expression objections, and several broader online-safety bills remain only proposed.

Framework: No single comprehensive cybersecurity statute. Obligations are distributed across sectoral and cross-cutting rules: financial-sector information-security/cyber requirements issued by the CNBV and Banco de México; breach/security-vulnerability duties under the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP, 2025); the Penal Code's computer-crime provisions; and the binding National Cybersecurity Plan 2025-2030 / General Cybersecurity Policy for the Federal Public Administration (ATDT). A comprehensive 'Ley General/Federal de Ciberseguridad' is proposed but not yet enacted.

As of mid-2026 Mexico lacks an enacted, economy-wide cybersecurity law; cyber obligations arise from sector-specific regulation (notably banking/fintech rules from the CNBV and Banxico), the 2025 data-protection law's security and breach-notification duties, and a 2025-2030 National Cybersecurity Plan that binds federal agencies. A General Cybersecurity Law creating a national cybersecurity agency and a critical-infrastructure registry was introduced in the Senate in April 2025 and remains under legislative consideration.

Framework: Ley de Inversión Extranjera (Foreign Investment Law) and Ley General de Sociedades Mercantiles, administered by the Secretaría de Economía; foreign capital recorded in the Registro Nacional de Inversiones Extranjeras (RNIE). Electronic incorporation of a Sociedad por Acciones Simplificada (SAS) is offered via gob.mx/tuempresa.

Mexico permits 100% foreign ownership in most sectors without a local partner, and offers a free electronic, notary-free SAS regime with no minimum capital. However, foreigners typically incorporate a S.A. or S. de R.L. before a notary/public broker, must register foreign capital in the RNIE within 40 business days, and face foreign-ownership caps (10%/49%) or outright reservation in specific strategic sectors.