Payment Licensing in Mexico: IFPE, ITF, and Local Acquiring Under CNBV and Banxico

"Get a PSP licence in Mexico" is a search query, not a regulatory category — and Mexico's answer to it is more fragmented than most operators expect. Mexico's payment regulation splits across two authorities, CNBV and Banco de México (Banxico), and across at least three separate operational tracks that rarely surface together in English-language coverage: the IFPE and IFC authorisation regime the 2018 Ley Fintech created, a much older and entirely separate registration framework that actually governs card acquiring, and the route most foreign operators take in practice — never obtaining Mexican authorisation directly at all.

This guide works through CNBV's actual authorisation structure — what IFPE and IFC cover, the verified capital figures and statutory timelines, and the harder question operators searching "PSP licence Mexico" are usually really asking: do you need any of this to acquire merchants locally, or does that run on a different track entirely. It completes a licensing triad with PaymentBrief's guides to PSP licensing and local acquiring in Brazil and payment aggregator licensing in India — three markets, three regulators, and three structurally different answers to what looks like the same question from outside. Mexico's SPEI rail has its own dedicated operator guide and isn't repeated here.

One sourcing note before the structure: Mexico's DOF (Diario Oficial de la Federación) legislative-gazette site and SAT's own web pages could not be reached as live sources during this research — DOF refused every connection attempt, and SAT's pages either redirected into a bot-challenge page or timed out. Everywhere those would normally be the primary citation, this guide instead relies on CNBV's and Banxico's own PDF-hosted regulatory texts (both reachable and current, one through a 6 July 2026 amendment), plus named, dated professional tax and legal sources for the IVA mechanics. Every specific figure below is sourced to one of those; anything that surfaced only as an unattributed AI-search summary during research — including a widely repeated foreign-ownership percentage for IFPEs — has been left out rather than asserted.

Mexico's Licensing Landscape: IFPE, ITF, and the Agregador Model

The Ley Fintech — formally the Ley para Regular las Instituciones de Tecnología Financiera, published 9 March 2018 and last amended 14 November 2025 — created an umbrella category called instituciones de tecnología financiera (ITF), then split it into two authorised sub-types. Instituciones de fondos de pago electrónico (IFPE) cover electronic payment funds: wallets, prepaid balances, and payment initiation without holding funds on the payer's behalf. Instituciones de financiamiento colectivo (IFC) cover crowdfunding — debt, equity, or co-ownership crowdfunding platforms. Both require CNBV authorisation under the same law, but they're different licences for different businesses; an operator building a wallet doesn't need to think about the IFC rules at all, and vice versa.

What the Ley Fintech does not cover is the activity most operators actually mean when they say "PSP licence": accepting card payments on behalf of merchants. That runs on a separate, older instrument — the CNBV/Banxico joint Disposiciones de Carácter General Aplicables a las Redes de Medios de Disposición, first published in 2014 under the Ley para la Transparencia y Ordenamiento de los Servicios Financieros (a different statute from the Ley Fintech entirely). This framework defines two roles relevant to acquiring: an Adquirente (acquirer), which contracts directly with a Banxico-authorised card clearing house and settles to merchants or to Agregadores, and an Agregador (aggregator), which contracts with an already-authorised Adquirente and offers merchants card-acceptance service without needing its own separate authorisation for that activity. Article 13 of these rules requires Adquirentes, Agregadores, and card-brand owners to register their fees and commissions with Banxico — a transparency obligation, not a licensing gate.

That structural split is the single most consequential fact in this guide. An operator who reads "Mexico requires an IFPE licence to move money" and concludes they need one to acquire merchants has confused two different regulatory tracks. The Agregador role — contractual, registered, riding on an Adquirente's existing authorisation — is functionally close to what Brazil calls a subcredenciadora and what India's Payment Aggregator framework treats as a sub-merchant relationship: a lighter-touch position for an entity that doesn't itself sit as the licensed principal.

CNBV Authorisation: Process, Capital, and Timelines

For operators who do need IFPE or IFC authorisation directly — because they're holding customer balances, issuing e-money, or building a lending-adjacent crowdfunding product rather than simply acquiring merchants — CNBV's process runs through the law's general procedural rules plus IFPE-specific secondary regulation (the CUIFPEs).

Entity form. Article 36 requires the applicant to be, or intend to become, a Mexican sociedad anónima with its registered address in Mexican territory, its corporate purpose limited to the licensed activity, and express acceptance of the law's provisions in its bylaws.

Minimum capital. The CUIFPEs set two capital tiers, both denominated in UDI (Unidades de Inversión), an inflation-indexed accounting unit Banxico recalculates daily. Article 6 sets the base tier — 500,000 UDI, approximately MXN 4.4 million at August 2026's UDI value — for an IFPE authorised only for domestic-currency operations, or an IFC authorised for a single type of domestic-currency crowdfunding activity. Article 7 sets a higher tier — 700,000 UDI, approximately MXN 6.2 million — for institutions also authorised for foreign-currency operations, virtual-asset operations, acting as a clearing house within means-of-disposal networks, virtual-asset derivatives, or that register debt securities with CNBV's national securities registry. The UDI figure is the actual regulatory number; the peso conversion moves daily and should be recomputed against Banxico's current UDI value before it's used in a budget.

Timeline. The law's general procedural rule (Article 5) gives Mexican financial authorities a default 90 calendar days to resolve an application, with silence deemed a negative resolution unless a specific rule says otherwise. That default doesn't apply to ITF authorisation, though: Article 6 extends the deadline to up to 180 days whenever CNBV must obtain another authority's opinion or the Inter-institutional Committee's agreement — and IFPE/IFC applications are structured to require exactly that. Treat 180 days as the statutory ceiling on CNBV's own decision clock, not as the full runway to market: it starts once a complete application is filed, and preparing the corporate structure, capital, governance, and compliance documentation beforehand is a separate, often longer, effort that the statute doesn't put a clock on at all.

Ongoing obligations that affect the licence itself. An authorised ITF that fails to begin operating within six months of its authorisation notice is subject to revocation on that ground alone — a real deadline worth building into a launch plan, not just a filing plan.

Local Acquiring vs Cross-Border Acquiring in Mexico

Because card acquiring sits outside the IFPE/ITF framework, the local-vs-cross-border question in Mexico is really a question about which network participant role you occupy under the Redes de Medios de Disposición rules, not about whether you hold a CNBV fintech authorisation. For the general framework — reach into domestic-only schemes, issuer approval treatment, avoided cross-border fees, and regulatory mandate — see PaymentBrief's local acquiring vs cross-border acquiring reference; Mexico doesn't have a domestic-only card scheme in the way Brazil's Elo or Saudi Arabia's Mada do, so the reach argument is weaker here than in those markets. What Mexico does have is a registered-participant structure that most foreign PSPs slot into as an Agregador rather than becoming an Adquirente in their own right.

An Adquirente contracts directly with a Banxico-authorised card-payment clearing house, receives merchants' authorisation requests, routes them to issuers through that clearing house, and settles the merchant. An Agregador contracts with an Adquirente instead of the clearing house directly, offers merchants card acceptance under that arrangement, and may supply the point-of-sale infrastructure — the role most foreign fintechs and payment platforms occupy in Mexico's market today, including several of the domestic PSPs Mexico's market page already lists. Neither role requires IFPE authorisation on its own; both are subject to Article 13's registration obligation for fees and commissions, and both sit inside a rulebook that separately caps interchange fees for card payments.

Cross-border acquiring into Mexico — settling through a foreign acquirer rather than a Mexican Adquirente or Agregador — remains viable for many merchant categories; nothing in the Redes de Medios de Disposición text reserves Mexican card acceptance to domestic-only participants the way a closed scheme would. The commercial case for going local is closer to the economics argument covered below than to a hard regulatory mandate.

Foreign-Entity Structuring: Can You Acquire Without a Mexican Entity?

For IFPE or IFC authorisation, no: Article 36 requires Mexican incorporation as a sociedad anónima with a Mexican registered address, full stop. There's no direct-branch or foreign-registration path into CNBV authorisation for either category.

Ownership of that entity is a separate question, and the answer is less restrictive than commonly assumed. Article 13 of the Ley Fintech states plainly that titles representing an ITF's capital stock may be freely subscribed — the law itself imposes no nationality-based ceiling on who can hold ITF shares. What both the law and the CUIFPEs do require, independent of nationality: CNBV pre-authorisation before anyone acquires 10% or more of an ITF's capital, or obtains control of it, with a lighter notice-only regime for smaller direct stakes and somewhat different thresholds for private-equity fund participation. That's a beneficial-ownership and fit-and-proper gate, not an ownership cap — a foreign parent can, on this reading of the primary texts, hold a controlling stake in a Mexican IFPE subject to that CNBV vetting, the same vetting a domestic controlling shareholder would face.

Worth flagging explicitly: a foreign-ownership percentage limit for IFPEs — most often cited as 49% — circulates widely in secondary commentary on Mexican fintech regulation. This guide could not verify that figure against the Ley Fintech text or the CUIFPEs during direct research of both documents, and it is not asserted here as a result. If a market-entry structure depends on a specific foreign-ownership ceiling, confirm it directly with Mexican financial-regulatory counsel rather than relying on the commonly repeated number.

For card acquiring rather than IFPE authorisation, the entity question is lighter still: the Redes de Medios de Disposición rules define Adquirente and Agregador by their contractual relationship to the clearing house or to an Adquirente, not by a stated nationality or incorporation requirement in the definitions themselves — consistent with why non-bank, foreign-founded PSPs already operate as Agregadores in Mexico's market today.

SPEI Settlement and Banxico's Role for Acquirers

Card acquiring and SPEI are separate rails governed by the same central bank but different rulebooks — Banxico operates SPEI directly as a real-time account-to-account transfer system, while its role in card acquiring is confined to the Redes de Medios de Disposición registration and interchange-cap framework covered above. An Adquirente or Agregador settling merchant proceeds typically does so via a SPEI transfer into the merchant's CLABE-addressed account, which means SPEI's operating characteristics — irrevocability once funds are deposited, no card-style chargeback mechanism, and a refund modelled as a fresh transfer rather than a reversal — apply to the settlement leg of an acquiring relationship even though SPEI itself isn't a card-acquiring regime. Operators building or auditing a Mexican acquiring or Agregador integration should treat SPEI's mechanics as the settlement layer underneath, not as part of the licensing question this guide covers; PaymentBrief's dedicated SPEI guide works through that layer in full.

Economics: Interchange, IVA, and Withholding

Two economic factors shape Mexican acquiring costs beyond the acquirer's own margin: the interchange framework the Redes de Medios de Disposición rules impose, and a tax-withholding regime that catches foreign operators far more often than the headline 16% IVA rate suggests.

Interchange. The Redes de Medios de Disposición rules give Banxico and CNBV joint authority to set Cuotas de Intercambio Máximas — maximum interchange fees for card payments — under principles of competition promotion, infrastructure expansion, free access, and non-discrimination set out in the underlying transparency statute. Adquirentes, Agregadores, and issuers must register their applicable fees and any changes with Banxico, and Banxico publishes aggregated fee information for transparency. The specific current fee schedule is a published, regularly-updated registry rather than a fixed figure this guide can responsibly state as static — confirm the current maximum against Banxico's published registry rather than any cached figure.

IVA on the transaction itself. Mexico applies a standard 16% IVA rate to goods, services, and most digital transactions — the same rate Mexico's market page already documents for card and platform fees generally.

The withholding surprise. Where IVA gets genuinely differentiating for a foreign operator is the digital-services withholding regime, in force since a January 2020 law change with operative rules published that July. Foreign residents providing digital services to Mexican consumers must register with SAT and charge IVA regardless of whether they have a permanent establishment in Mexico — a lower bar to trigger registration than most operators expect from a market they don't have local staff in. Where a Mexican intermediary platform collects the consideration on a foreign provider's behalf, the withholding scales with two things: the seller's registration status, and — the part that actually surprises operators — where the money lands. PwC's Mexico tax summary describes up to 100% of IVA being withheld when the corresponding funds are deposited into a foreign bank account rather than a Mexican one, on top of separate withholding tiers (50% from Mexican resident legal-entity sellers, rising to 100% without a registered tax ID; 100% from non-residents selling goods without a Mexican permanent establishment). For a foreign PSP or platform settling Mexican revenue offshore by default, that's a direct cash-flow cost that has nothing to do with licensing and everything to do with where the settlement account sits — and it's the kind of detail that doesn't show up until an operator is already live and reconciling a shortfall against expected net revenue.

Common Licensing Mistakes and Realistic Timelines

Assuming IFPE authorisation is required to acquire merchants. It isn't. Acquiring runs through the Adquirente/Agregador registration framework; IFPE covers e-money, wallets, and payment initiation. Conflating the two leads operators to budget for the wrong authorisation entirely.

Treating the 90-day statutory clock as the real timeline. It's the ceiling on CNBV's own resolution period once a complete application is filed — and for IFPE/IFC specifically, that ceiling is 180 days, not 90, because of the Inter-institutional Committee requirement. Neither figure includes pre-filing preparation: corporate structuring, capital funding, governance design, and compliance-programme buildout, which routinely take longer than the statutory decision period itself.

Underestimating the six-month operating deadline. Authorisation isn't the finish line — an ITF that doesn't begin operating within six months of notification risks revocation on that ground alone, independent of any other compliance issue.

Budgeting around an unverified foreign-ownership cap. The widely repeated 49% figure for IFPE foreign ownership isn't traceable to the Ley Fintech text or its CUIFPEs secondary rules; the actual constraint is a CNBV beneficial-ownership and control review applied regardless of nationality, layered on top of a free-subscription rule with no stated ceiling. Structuring an entity around an unverified percentage is a real risk to the deal, not just to the article.

Ignoring settlement-location IVA exposure until after launch. Where proceeds settle — a Mexican account versus a foreign one — changes IVA withholding exposure under the digital-services regime. That's a treasury decision with a tax consequence, not a licensing decision, and it's easy to make by default rather than deliberately.

Partner With a Licensed Acquirer vs Go Direct

Which Category Do You Actually Need?

Before You Structure Around Any Figure Here

Mexico's licensing texts are more stable than Brazil's currently-transitioning capital regime — the CUIFPEs capital figures and the law's procedural deadlines are settled, current rules, not mid-reform numbers — but two things in this guide are explicitly not settled: the peso conversion of any UDI-denominated figure, which moves daily with Banxico's published index, and the foreign-ownership question, where this guide reports what Article 13 and the CUIFPEs actually say rather than the commonly repeated 49% figure it could not verify. Confirm both directly — current UDI value against Banxico's published series, and any ownership-structuring question against Mexican financial-regulatory counsel — before committing a market-entry budget or corporate structure to either.