Crypto ATM / kiosk operator in Mexico
Physical kiosks that exchange cash for crypto (and sometimes vice versa). High-cash AML risk profile.
Crypto ATM is conditionally permitted in Mexico without local incorporation, subject to AML obligations and low licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- Low
- Last updated
- 2026-07-13
AML Obligations
- Register as a vulnerable activity under the Federal AML Law (Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita) — non-financial entities providing virtual asset services fall under this classification
- Implement KYC procedures for all customers (mx.licensing.amlkyc-mandatory-for-all-providers)
- Establish internal policies and transaction monitoring systems (mx.licensing.amlctf-law-ley-federal-para)
- Report suspicious transactions and cash/asset transactions above thresholds to Mexico's Financial Intelligence Unit (FIU) (mx.licensing.financial-intelligence-unit-fiu-and)
- Comply with any AML/CTF extensions authorized under the Fintech Law (mx.licensing.law-to-regulate-financial-technology)
Key Restrictions
- Cannot operate as or through a regulated financial institution (bank, fintech ITF) — those entities are banned from client-facing virtual asset services under Banxico Circular 4/2019 (mx.licensing.circular-42019-banxico-limits-financial)
- Non-financial entity status means no authorization from Banxico is available or required — the operator must remain outside the regulated financial sector (mx.licensing.exchanges-custody-providers-payment-processors)
- Cash-in / cash-out operations at a kiosk are classified as a 'vulnerable activity' under AML law, not a money-transmission service, so no money-transmitter license exists
- No explicit minimum capital requirement for non-financial VASPs (mx.licensing.capital-no-specific-minimum-capital)
- If incorporating locally, must comply with standard Mexican company setup: notary, RFC tax registry, e-signature, foreign investment registry (if applicable), bank account (mx.licensing.local-presence-no-explicit-requirement)
Key Risks
- Regulatory ambiguity — no approvals have been granted by Banxico post-2019 secondary rules (mx.licensing.no-approvals-granted-by-banxico), and the existing framework is designed for financial institutions, not kiosk operators, creating legal uncertainty
- High AML enforcement risk — Mexico is a high-risk jurisdiction for crypto-related money laundering; U.S. and OFAC enforcement actions have targeted crypto laundering linked to cartels (mx.enforcement.ofac-sept-26-2023-sanctioned, mx.enforcement.us-authorities-nov-20-2024, mx.enforcement.us-authorities-mar-17-2023)
- Cash-intensive operations invite enhanced scrutiny from FIU and potential fines up to ~$47,000 for non-compliance (mx.licensing.no-approvals-granted-by-banxico)
- No formal licensing or registration pathway exists for non-financial crypto operators, creating a risk that authorities could later deem kiosk operations unlawful or require retroactive registration
- Tax and PR exposure — virtual assets are not legal tender, and operators must ensure contractual acceptance; lack of formal classification creates tax-reporting ambiguity (mx.licensing.other-cryptoassets-not-formally-classified)
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
AML/CTF Law (Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita): Classifies virtual asset operations by non-financial entities as vulnerable activities, requiring KYC, internal policies, transaction monitoring, and reporting to the Financial Intelligence Unit (FIU) for transactions over ~$58,000 MXN (645 UMAs) per client in six months.
AML/KYC: Mandatory for all providers serving Mexican residents, including:
Exchanges, Custody Providers, Payment Processors (Non-Financial Entities): No license or registration needed; services can be offered to the public if not reserved for regulated entities.
Financial Institutions/Fintechs: Authorization from Banxico required for any virtual asset operations; prohibited from public services.
Circular 4/2019 (Banxico): Limits financial entities to internal virtual asset operations with prior approval; bans public-facing services.
Capital: No specific minimum capital mandates in search results for virtual asset providers.
Local Presence: No explicit requirement, but company setup (if incorporating) needs Mexican notary, share certificates, corporate books, tax registry (RFC), e-signature, foreign investment registry (if applicable), and bank account. Office rental may aid compliance.
Financial Intelligence Unit (FIU) and Ministry of Finance and Public Credit (SHCP): Enforce AML/CTF reporting for transactions above thresholds; SHCP oversees broader AML/CTF implementation.
Law to Regulate Financial Technology Companies (Fintech Law), enacted March 9, 2018: Defines virtual assets as electronically registered value representations used for payments (not legal tender); empowers Banxico to regulate and authorizes AML/CTF extensions; requires risk disclosures.
Fintech Law (Ley para Regular las Instituciones de Tecnología Financiera): Defines virtual assets and grants Banxico regulatory powers but excludes non-financial custody from licensing.
No approvals granted by Banxico post-2019 secondary rules, with fines up to $47,000 for violations.
Banxico: Regulates virtual assets for financial institutions; authorizes internal operations but bans client-facing custody.
Other cryptoassets: Not formally classified; utility tokens staying on native platforms are typically outside regulation, while payment tokens can fulfill obligations if contractually agreed. Virtual assets are not legal tender or currencies.
OFAC (Sept 26, 2023): Sanctioned Mario Alberto Jimenez Castro (Sinaloa Chapitos faction) for laundering via cryptocurrency. Elliptic
U.S. authorities (Nov 20, 2024): Seized $5.4M in three wallets (one VASP) for cartel money laundering. Same source.
U.S. authorities (Mar 17, 2023): Arrested Sergio Antonio Duarte Frias (Sinaloa) in Guatemala for laundering $869K narcotics proceeds via cryptocurrency. Same source.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Crypto ATM/kiosk operations are permitted in Mexico only as a non-financial vulnerable activity under AML law (no Banxico authorization available or required), subject to AML registration, KYC, and transaction monitoring obligations, but operate in a regulatory gray area with no dedicated licensing pathway and heightened enforcement risk.
Questions this verdict aims to answer
- What money-transmitter / kiosk-specific license is required?
- What cash-transaction reporting thresholds apply?
- What enhanced-KYC obligations attach to cash-in / cash-out?