Estimated reading time: 4 minutes · Last updated:
Mexico should move now to what many call Fintech Law 2.0: a focused update to the 2018 Fintech Law that makes consented data sharing practical, reciprocal and staged. By the end of 2025 about 1,000 fintech initiatives were active in Mexico, according to Fintech México, and many still operate outside the specific open finance framework. Federica Gregorini argues this window matters because the regulator already has the authority to set secondary rules and the country is pursuing wider digitalisation under President Claudia Sheinbaum; as first reported by Mexico Business News, those two facts make a carefully staged update feasible without new legislation. The piece below explains what that update should fix and what Mexico can learn from Brazil’s scale.
Key takeaways
- Legal starting point: Mexico’s 2018 Fintech Law created an open finance framework that regulators began implementing in 2020.
- Market momentum: By the end of 2025 about 1,000 fintech initiatives were active in Mexico, per Fintech México, though only a fraction held CNBV authorisation.
- Design focus: A staged approach that begins with less-sensitive data and builds reciprocity and standard consent models is the recommended path.
- International benchmark: Brazil counted more than 138 million people with active open finance consents in July 2026, versus its 214 million population, showing what scale can look like.
Table of contents
Why now: market scale and a digitalisation push
The operational case for updating Mexico’s open finance rules is simpler than it sounds: the market is already moving. Fintech México reported roughly 1,000 active fintech initiatives by the end of 2025, and many of those businesses are connecting data and integrating services today even without a completed secondary rulebook. That gap — active technical integration paired with incomplete sector-specific rules — creates regulatory friction and legal uncertainty for firms that want to scale.
Political momentum reinforces the window of opportunity. President Claudia Sheinbaum’s administration has emphasised simplifying and digitalising public services in 2026, which makes an industry-focused, regulator-led update more politically feasible. The Comisión Nacional Bancaria y de Valores (CNBV) already holds the authority to issue the secondary rules needed, so the next phase is procedural: design standards, align industry players and publish the technical requirements.
Design priorities for Fintech Law 2.0
A practical draft focuses on three mechanics: staged data scope, clear consent models, and reciprocity between institutions. Staging means starting with directory and reference data before opening transactional histories; this reduces initial privacy and security risk while proving the model. Consent should be specific to each use, not an unread generic checkbox, and standards should require machine-readable, revocable permissions so users and third parties can automate control.
Reciprocity matters because one-sided access concentrates advantage. If an institution can consume another’s data without allowing the reverse, competition and market entry are hindered. Gregorini argues that reciprocity should be enforced and that charging another regulated party to share data that is legally required would create unnecessary cost barriers to adoption.
What Brazil’s scale teaches Mexico
Brazil’s open finance rollout provides a concrete benchmark: by July 2026 more than 138 million people had active data-sharing consents in its ecosystem, versus a 214 million population. That penetration shows how fast consent adoption can grow once standards, utility services and participant incentives align. Mexico should not copy Brazil line-for-line, but the Brazilian case shows the payoff from strong technical governance and persistent public–private coordination.
Two technical lessons matter. First, a governance body that includes both public and private participants can keep standards current without frequent statutory rewrites. Second, focus on use cases that deliver visible consumer benefit early — credit pricing, payments convenience or SME onboarding — because visible wins drive consent acceptance and wider participation.
The case for and against rapid secondary rules
The case for
- CNBV already has rulemaking authority and can issue secondary regulation without new Congressional legislation, shortening the timetable to meaningful standards.
- Industry momentum and the government’s 2026 digitalisation agenda increase political acceptability and the chance of constructive public–private design.
- A staged approach that begins with less-sensitive datasets lowers initial privacy and security risk while allowing practical testing and iteration.
The case against
- Many fintechs currently operate outside the explicit open finance framework, so rule changes risk excluding or disrupting firms unless transition paths are clear.
- If reciprocity is not enforced, dominant incumbents could capture the benefits while keeping rivals constrained, reducing competition.
- Requiring payments for mandatory data sharing would raise costs and slow adoption unless regulators prohibit such charges.
What to be careful about
- Regulatory delay would leave a large portion of the market operating under general rules (data protection, AML) rather than a tailored open finance regime, prolonging legal uncertainty for firms.
- Poorly designed consent standards could create consumer confusion and lower uptake, undercutting the system before it reaches useful scale.
- Allowing non-reciprocal access or permitting fees for required data exchange would entrench incumbents and raise costs for new entrants and consumers.
The bottom line
Mexico has a practical path to Fintech Law 2.0 that does not require new legislation: use the CNBV’s existing authority to publish staged secondary rules, codify specific consent models and obligate reciprocity between institutions. Doing so would channel the momentum of close to 1,000 active fintech initiatives into a system that can scale trust and competition. The alternative — waiting for a complete, perfect statute — risks leaving the market fragmented and consumers unable to benefit from broader, consented data use.
What to watch
- Watch for the CNBV to publish secondary rules for open finance; no date has been set.
- Watch for the formation of a public–private governance body to maintain technical standards; no date has been set.
Frequently asked questions
What is Fintech Law 2.0?
Fintech Law 2.0 refers to a targeted update of Mexico’s 2018 Fintech Law that would give the CNBV clear secondary rules for open finance, including staged data scopes and standardised consent mechanisms.
How many fintechs are already active in Mexico?
Fintech México reported close to 1,000 active fintech initiatives by the end of 2025, though only a fraction held formal authorisation from the CNBV.
Why look at Brazil?
Brazil’s open finance ecosystem had more than 138 million active consents by July 2026 against a 214 million population, showing how fast user consent can scale when technical standards and governance align.
Related reading
