Self-custodial wallet / non-custodial software in Mexico
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Mexico without local incorporation, subject to AML obligations and low licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- No
- Licensing burden
- Low
- Last updated
- 2026-07-13
AML Obligations
- AML/CTF obligations under the Federal AML Law (Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita) classify virtual asset operations by non-financial entities as 'vulnerable activities', requiring KYC/identity verification for users, internal AML policies, transaction monitoring, and reporting to the Financial Intelligence Unit (FIU).
- Reporting obligations apply to transactions above thresholds set by the FIU/SHCP under the Federal AML Law.
- Non-custodial wallet publishers without custody, control, or access to user funds likely do not independently trigger VASP/MSB classification under the Fintech Law, which focuses on financial institutions and FTIs handling virtual assets.
- However, if the software publisher incorporates locally or is deemed a 'non-financial entity' conducting vulnerable activities, CNBV-supervised AML/CTF compliance obligations may still attach to the Mexican legal entity.
Key Restrictions
- The publisher must not hold, control, or have access to user private keys or funds — this is definitional to the model and is what keeps the activity outside Fintech Law licensing.
- If the publisher were to ever custody or control user funds (e.g., via a hosted wallet component), it would likely fall under Fintech Law regulation requiring Banxico authorization (~60 banking days) and be prohibited from offering public-facing services under Circular 4/2019.
- Security tokens (tokenized stocks/bonds) fall under Securities Market Law and would trigger additional securities regulation irrespective of custody model.
Key Risks
- Regulatory ambiguity: The Fintech Law and secondary rules (Circular 4/2019) were written for financial institutions and FTIs, leaving non-custodial software publishers in a grey area with no formal classification or guidance.
- AML/CTF exposure: Even without custody, if a Mexican entity publishes the wallet and serves Mexican residents, AML vulnerable-activity obligations could be interpreted to apply, creating compliance burden without clear supervisory guidance.
- Enforcement risk: MX enforcement actions are cartel/money-laundering focused; a non-custodial wallet publisher could face indirect scrutiny if its software is used for illicit transactions, especially if it has a local corporate presence.
- No approvals granted by Banxico post-2019 secondary rules, with fines up to $47,000 for violations — regulatory uncertainty means a wrong classification could carry penalties.
- Stablecoin/specific token risk: If the wallet supports certain stablecoins where the issuer receives/manages public funds, those activities may fall under Fintech Law, creating potential liability for the wallet integrator.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
AML/CTF Law (Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita): Classifies virtual asset operations by non-financial entities as vulnerable activities, requiring KYC, internal policies, transaction monitoring, and reporting to the Financial Intelligence Unit (FIU) for transactions over ~$58,000 MXN (645 UMAs) per client in six months.
Fintech Law (Ley para Regular las Instituciones de Tecnología Financiera): Defines virtual assets and grants Banxico regulatory powers but excludes non-financial custody from licensing.
Exchanges, Custody Providers, Payment Processors (Non-Financial Entities): No license or registration needed; services can be offered to the public if not reserved for regulated entities.
AML/KYC: Mandatory for all providers serving Mexican residents, including:
No public process details for non-financial VASPs, as none required.
No approvals granted by Banxico post-2019 secondary rules, with fines up to $47,000 for violations.
Circular 4/2019 (Banxico): Limits financial entities to internal virtual asset operations with prior approval; bans public-facing services.
Fintech Law (2018): Regulates FTIs handling virtual assets. https://www.diputados.gob.mx/LeyesBiblio/pdf/LIFT_200318.pdf
Federal AML Law (as amended 2018): Covers virtual asset transactions. https://www.diputados.gob.mx/LeyesBiblio/pdf/LFPIORPI_180818.pdf
Financial Intelligence Unit (FIU) and Ministry of Finance and Public Credit (SHCP): Enforce AML/CTF reporting for transactions above thresholds; SHCP oversees broader AML/CTF implementation.
Security tokens: Those representing or underlying securities (e.g., tokenized stocks or bonds) fall under Securities Market Law scope.
Certain stablecoins: If issuers receive, manage, safeguard public funds, and enable redemption/transfer, they may fall under the Fintech Law (Ley para Regular las Instituciones de Tecnología Financiera, March 2018).
Other cryptoassets: Not formally classified; utility tokens staying on native platforms are typically outside regulation, while payment tokens can fulfill obligations if contractually agreed. Virtual assets are not legal tender or currencies.
Law to Regulate Financial Technology Companies (Fintech Law), enacted March 9, 2018: Defines virtual assets as electronically registered value representations used for payments (not legal tender); empowers Banxico to regulate and authorizes AML/CTF extensions; requires risk disclosures.
Local Presence: No explicit requirement, but company setup (if incorporating) needs Mexican notary, share certificates, corporate books, tax registry (RFC), e-signature, foreign investment registry (if applicable), and bank account. Office rental may aid compliance.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- medium
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — Non-custodial wallet software publishing (no custody of user funds) does not trigger Fintech Law VASP licensing in Mexico, but if a local entity is involved, AML vulnerable-activity obligations under the Federal AML Law may attach, and the activity exists in a grey area with no formal regulatory recognition or guidance.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?