Mexico: Legal for Everyone Except the Banks — A Registration Regime, Not a Licence

Mexico has no crypto ATM licence to apply for — operators simply register as a regulated business and report transactions, and machines are already running in several cities. The catch is what counts as reportable keeps getting lower.

● Grey

210 UMA (~$1,300) New AML reporting threshold, down from 645 UMA (July 2025 reform)

4+ cities Live ATM network already running (Mexico City, Puebla, Querétaro, Naucalpan)

+70% YoY Spike in UIF alerts as the tightened AML framework took hold

Buying, selling, and operating a crypto ATM in Mexico is fully legal for individuals and ordinary (non-financial) businesses, and a live multi-city ATM network already exists — machines are confirmed operating in Mexico City, Puebla, Querétaro, and Naucalpan, among other locations.¹ Mexico has deliberately not created a standalone VASP licence: instead, an ATM operator registers with the SAT (Tax Administration Service) as conducting an "actividad vulnerable" (vulnerable activity) under the LFPIORPI anti-money-laundering law, and reports transactions to the Financial Intelligence Unit (UIF) — a registration-based compliance regime rather than a discretionary licence to apply for and wait on.^2,3 The advantage is real: this is one of the faster, lower-cost regulatory paths in this entire series, since there is no licence application to win or lose, only a compliance framework to build correctly. The obstacle is that Mexico's Fintech Law explicitly walls off banks and licensed fintech institutions from offering crypto services directly to their own customers, and a sweeping July 2025 AML reform sharply lowered reporting thresholds, meaning almost every meaningful ATM transaction now triggers a mandatory filing.^4,5 As in most markets on our legislation map, General Bytes as a hardware and software vendor is not itself performing a licensable activity; it is the in-country operator of the machines who must register as a vulnerable-activity entity. For GENERAL BYTES, Mexico is a genuinely accessible, already-proven market — the compliance bar is real but achievable without the multi-year licensing marathon seen in several other countries in this series.

Last updated: July 2026

Regulatory Framework and Its Evolution

Mexico's 2018 Fintech Law (Ley para Regular las Instituciones de Tecnología Financiera) was genuinely pioneering for Latin America, giving Banco de México (Banxico) broad powers over how regulated financial institutions may interact with virtual assets.⁴ Banxico used that power conservatively: rather than opening the door for banks and fintechs to offer crypto products to retail customers, it has kept what industry commentary calls a "healthy distance," restricting virtual-asset use by regulated institutions to narrow internal operations only.^6,7 Crucially, this restriction applies to banks and CNBV-licensed fintech institutions (IFPEs), not to ordinary non-financial businesses — which is exactly the category a standalone crypto ATM operator normally falls into, and why the activity remains legal for such an operator even though banks cannot offer the same service.

On the AML side, the UIF determined as early as 2015 (applying FATF's risk-based guidance on virtual currencies) that crypto exchange, custody, and transfer activity by non-financial platforms constitutes a "vulnerable activity" under LFPIORPI, and a July 2025 reform (published in the Diario Oficial de la Federación) substantially tightened this regime — broadening beneficial-ownership definitions, updating the concept of a business relationship, and expanding the vulnerable-activities list, explicitly to align Mexico more closely with FATF standards.^8,5 Reform momentum continues: the fintech industry and CNBV's new chairman, Ángel Cabrera, launched a push in mid-2026 for a broader "Fintech Law 2.0," with substantial progress expected around the end of 2026 or start of 2027.

Getting Registered: SAT/UIF Vulnerable-Activity Registration

There is no CNBV or Banxico licence to apply for here in the sense used elsewhere in this series. A crypto ATM operator registers with the SAT as an entity conducting activities involving the habitual or professional exchange of virtual assets, then establishes its ongoing reporting relationship with the UIF.^2,3 This process combines in-person procedures at SAT offices with online steps, requires appointing a Compliance Representative (certification is currently optional but increasingly treated as standard practice), and includes customer identification, sanctions screening, and monthly AML reporting obligations.^9,10 Because this is a registration-based framework rather than a discretionary authorisation, overall setup costs and timelines tend to run lower than jurisdictions requiring a full licence application — the binding constraint is the quality of the compliance build, not a lengthy regulator review-and-approval cycle.³

This is one of the faster, lower-cost regulatory paths in this entire series, since there is no licence application to win or lose, only a compliance framework to build correctly.
ON MEXICO'S SAT/UIF REGISTRATION MODEL

A notable, explicit rule worth flagging: the UIF has confirmed that any person or entity — local or foreign — providing cross-border vulnerable activities (including operating a crypto exchange platform) directly to Mexican residents must comply with the full set of Mexican AML obligations, regardless of where the operator is based.¹⁰ As with the rest of our legislation map, this registration sits with the in-country operator of the machines, not with General Bytes as hardware and software vendor.

AML and KYC

This is the area where Mexico has tightened most sharply and most recently. The July 2025 LFPIORPI reform cut the mandatory reporting threshold for virtual-asset operations from 645 UMA to just 210 UMA per operation — roughly 24,635 pesos (about USD 1,300) at 2026 values — meaning a large share of ordinary ATM transactions now trigger a formal filing with the UIF, not just unusually large ones.¹¹ The reform went further with a micro-reporting mandate: platforms must report whenever they charge a commission or fee of as little as 4 UMA (roughly 469 pesos, about USD 25), regardless of the size of the underlying transaction — a rule specifically designed to close a gap where operators might otherwise structure fees to stay under the main threshold.¹¹ From April 2026, domestic exchanges must additionally provide the SAT with real-time access to user transaction data, and Mexico's UIF reported a 70% year-over-year spike in total alerts as this tightened framework took hold — virtual assets are now the single most-reported vulnerable-activity category nationally.¹² This places Mexico firmly in the full-reporting category rather than offering any meaningful anonymity tier, and the trend is unambiguously toward more disclosure, not less.

Reporting threshold before July 2025 645 UMA per operation	Reporting threshold from July 2025 210 UMA per operation — roughly 24,635 pesos (~USD 1,300)
Micro-reporting mandate Any commission/fee of 4+ UMA (~469 pesos, ~USD 25) must be reported	Real-time SAT data access From April 2026, domestic exchanges must give SAT live transaction data

Banking

Banking access sits in a genuinely two-tier structure. A properly registered, AML-compliant vulnerable-activity business (the category a standalone ATM operator falls into) can generally access ordinary commercial banking as a registered Mexican company — the Fintech Law's restriction targets banks and CNBV-licensed fintechs offering crypto products to their own customers, not an ordinary company's own operating account.^4,6 That said, heightened scrutiny of the whole sector — including a June 2025 US Treasury allegation against three major Mexican financial institutions over alleged money laundering — means banks may still apply extra diligence to any account holder whose business is visibly crypto-related, even where full compliance is in place.

The Next 24 Months: Tightening AML, Possible Fintech Law 2.0

Two forces will shape this market over the next two years. First, AML enforcement infrastructure keeps expanding on the current registration-based foundation — the April 2026 real-time SAT data-access requirement and the sharply lowered reporting thresholds both signal a regulator building out enforcement capacity within the existing regime rather than replacing it.^12,11 Second, a more structural reform — "Fintech Law 2.0" — is now actively being pushed by industry and CNBV's new leadership, aimed at creating clearer rules for crypto assets, open finance, and new business models; substantive progress is anticipated toward the end of 2026 or start of 2027, though the shape of any dedicated VASP regime (if one emerges) is not yet determined.^13,14

For GENERAL BYTES, Mexico is one of the more immediately workable markets in this series: the legal pathway exists today, machines are already running in multiple cities, and the registration-based compliance model avoids the multi-year, high-capital licensing battles seen in markets like Germany, Austria, or Hong Kong's VATP regime. The practical priorities are to build AML/compliance infrastructure around the new, much lower reporting thresholds from day one — treating most transactions as reportable by default — and to monitor the Fintech Law 2.0 process, since a future dedicated VASP framework could change the registration path described here, likely toward more formal licensing rather than less.

---

Sources and references

1. Existing multi-city Mexican crypto ATM network (Mexico City, Puebla, Querétaro, Naucalpan) — swapzone.io
2. SAT registration for vulnerable-activity entities, no standalone VASP licence — irglobal.com
3. UIF reporting relationship and lower relative cost vs. licensing regimes — irglobal.com
4. Fintech Law granting Banxico authority over financial institutions' virtual-asset use — ccn.com
5. July 2025 LFPIORPI reform aligning with FATF standards — mexicobusiness.news
6. Banxico's conservative "healthy distance" stance since 2019 — globallegalinsights.com
7. Restriction applying to banks/fintechs, not non-financial businesses — globallegalinsights.com
8. UIF's 2015 interpretive criterion applying AML law to cryptoassets — globallegalinsights.com
9. SAT registration process, Compliance Representative appointment — globallegalinsights.com
10. UIF criteria on cross-border vulnerable-activity obligations — resourcehub.bakermckenzie.com
11. July 2025 threshold reduction (645→210 UMA) and micro-reporting mandate — aureobitcoin.com
12. 70% YoY spike in UIF alerts, real-time SAT data access from April 2026 — mexicobusiness.news
13. Fintech Law 2.0 industry/CNBV push, June 2026 — license.aiying.cc
14. Expected timeline (end 2026/start 2027) for substantial progress — license.aiying.cc

Legal Disclaimer: This article by GENERAL BYTES is for informational purposes only and does not constitute formal legal, financial, or investment advice. Mexico's AML reporting thresholds were substantially lowered in July 2025 and a broader Fintech Law 2.0 reform is under active discussion; always consult specialised local legal counsel and confirm current SAT and UIF requirements before considering market entry.