Fintech & SOFOM

Two doors into lending and payments: the SOFOM and the Fintech Law

A foreign group that wants to lend, lease, factor or move money in Mexico without a banking license has two regulated doors. The first is the SOFOM, the Sociedad Financiera de Objeto Múltiple created by the 2006 reform of the Ley General de Organizaciones y Actividades Auxiliares del Crédito: a Mexican corporation whose purpose is granting credit, financial leasing and factoring, and which requires registration and anti-money-laundering supervision rather than a license. The second is the Ley para Regular las Instituciones de Tecnología Financiera of 2018, the Fintech Law, which created two authorized institutions: crowdfunding platforms (instituciones de financiamiento colectivo) and electronic-payment-fund institutions (instituciones de fondos de pago electrónico), the legal form of wallets and payment accounts.

Which door fits depends on the business, not on the technology. Consumer and commercial lending, equipment leasing and receivables finance fit a SOFOM. Holding customers’ balances and moving them between users requires the payments authorization or a partnership with an institution that holds it. Marketplace lending between investors and borrowers is crowdfunding and requires its own authorization. We structure the vehicle around the product the group actually intends to sell in Mexico.

SOFOM E.N.R.: unregulated in name, supervised in practice

A SOFOM is incorporated as a sociedad anónima with the required corporate purpose and the E.N.R. (entidad no regulada) suffix if it is not linked to a bank or financial group and does not issue publicly traded debt. The word unregulated is misleading. Before it can register with the consumer-protection agency for financial services (CONDUSEF), it must obtain a favorable technical opinion from the banking regulator (CNBV) on its anti-money-laundering framework, and it remains subject to CNBV supervision on that front: a compliance officer, manuals, customer identification and the reporting of relevant, unusual and internal-concern operations.

The consumer-protection layer is dense as well. Adhesion contracts are registered with CONDUSEF; the entity must maintain a specialized customer-service unit and appear in the agency’s registries; the transparency law requires disclosure of the total annual cost of credit and regulates fees and statements; and a SOFOM must report its borrowers to at least one credit bureau. Collection practices are regulated and collection agents are registered. Tax treatment as part of the financial system is available when lending activity reaches the statutory proportion of the entity’s assets or income, which affects how interest is invoiced and how bad debts are deducted.

We incorporate the SOFOM, prepare and defend the CNBV file, complete the CONDUSEF registrations and then run the recurring compliance calendar, because the registration is the day the obligations begin, not the day they end.

Fintech Law authorizations: payment funds and crowdfunding

An electronic-payment-fund institution or a crowdfunding institution operates under an authorization granted by the CNBV with the agreement of an interinstitutional committee in which the Ministry of Finance and the central bank participate. The file is a business: a business plan, minimum capital measured in investment units, corporate governance and fit-and-proper shareholders and officers, information-security and operational-risk policies, an anti-money-laundering program and the contracts customers will sign. The authorization is followed by ongoing reporting to the CNBV and by the central bank’s rules on the operations the institution may carry out.

Three features of the law shape strategy. Operations with virtual assets require the central bank’s prior authorization, and its rules have kept authorized institutions from offering them to customers, so a crypto product is not something a Mexican license delivers by default. Authorized institutions must expose standardized application-programming interfaces for the exchange of data under the open-finance provisions. And the law allows temporary authorizations for novel models, a regulatory sandbox with a limited term and scope, for products that do not fit the existing categories.

Changes in significant shareholders of an authorized institution require regulatory clearance, so the group’s exit and financing plans have to be designed with the license in mind. We prepare the authorization file, manage the dialogue with the CNBV and, where the timeline does not fit the business plan, structure the launch through a partnership with an already authorized institution while the group’s own authorization is processed.

Foreign groups: which vehicle for which business

Foreign capital may hold a SOFOM and an authorized fintech institution through a Mexican company, and the foreign-investment registration and beneficial-controller obligations described in our Foreign Investment practice apply from day one. The shareholders’ and officers’ files for the CNBV go deeper than the corporate registrations: source of funds, track record and criminal-record certificates reach the individuals at the top of the chain.

The typical map is this. A lender arriving in Mexico incorporates a SOFOM E.N.R. and, if it will fund itself in the local market, plans early for the regulated variant that issuing securities requires. A payments or wallet business decides between its own authorization and launching on a partner’s license, a decision driven by time to market, control of the customer relationship and the cost of compliance. A marketplace-lending model files as a crowdfunding institution. A bank that wants a Mexican footprint without a banking license often starts with a SOFOM linked to its group, which makes it a regulated SOFOM with additional prudential obligations.

AML, data and consumer protection: the obligations that run every day

The anti-money-laundering program is the spine of a Mexican financial entity: customer identification and know-your-customer files, risk classification, monitoring, the reports to the financial intelligence unit through the CNBV, training and an annual independent review. The obligations are the same in kind for a SOFOM and for an authorized fintech, and they are the first thing the supervisor examines.

Personal data is the second front. Mexico overhauled its federal data-protection law in 2025 and reassigned the supervisory authority, so privacy notices, consent mechanics, cross-border transfers and security measures designed under the previous regime have to be revisited. The third front is the customer: CONDUSEF handles complaints and can sanction, and the transparency rules govern the wording of contracts, statements and advertising. We run these three fronts as one compliance calendar, with one owner per task, and we defend the entity before the authorities when a proceeding starts.

Frequently asked questions

Do we need a banking license to lend in Mexico?

No. Lending, financial leasing and factoring can be carried out by a SOFOM, which does not require a banking license. It does require incorporation with the proper purpose, a favorable technical opinion from the CNBV on its anti-money-laundering framework, registration with CONDUSEF and ongoing compliance with the AML, transparency and credit-bureau rules. Taking deposits from the public remains reserved to licensed institutions.

How long does it take to set up a SOFOM?

Incorporating the company is a matter of weeks. Obtaining the CNBV’s technical opinion and completing the CONDUSEF registrations is measured in months and depends on the quality of the file and the authority’s workload at the time. We prepare the compliance framework in parallel with the incorporation so that the regulatory file is complete on the day the company exists.

Can a foreign fintech offer wallets or payment accounts in Mexico without a Mexican authorization?

Not directly. Holding customers’ funds and transferring them between users is the activity the Fintech Law reserves to electronic-payment-fund institutions authorized by the CNBV. A foreign group either obtains its own authorization through a Mexican company or launches on the license of an already authorized institution under a partnership agreement, while its own file is processed.

Can a Mexican fintech or SOFOM hold or trade crypto assets for customers?

Only with the central bank’s prior authorization, and its rules have kept authorized institutions from offering virtual assets to their customers, allowing them essentially for internal operations. A crypto product is therefore not something a Mexican license delivers by default, and any plan built on it must be checked against the central bank’s current rules.

What are the recurring obligations once the entity is registered or authorized?

Anti-money-laundering reports and an annual independent review, CONDUSEF registrations and their updates, credit-bureau reporting, transparency disclosures on contracts and statements, periodic regulatory reports for authorized institutions, corporate and foreign-investment filings, the beneficial-controller file, and tax and accounting compliance. We deliver them as one calendar with owners, which is the only way they get done on time.