Mexico's National Banking and Securities Commission (CNBV) has updated its rules to allow banks to deliver authentication codes by SMS for certain operations carried out through technology-based commission agents. The modification was published on September 1 and took effect on September 2, according to the Diario Oficial de la Federación. It preserves the use of a client-defined password and adds text messaging as a valid contact channel, while also introducing a simpler identity verification process for balance and transaction inquiries.
New Flexibility for Authentication Channels
Under the revised provisions, institutions may send category 3 authentication factors to the mobile number registered by the client as an additional delivery channel. This expands the previous framework, which contemplated email or encrypted messaging applications as valid options for secure communication. The SMS code must then be entered into the bank's system to confirm the user's identity and complete the operation.
How the Updated Process Works
When a customer initiates a covered transaction on a third-party application or website, the platform redirects the user to the bank's technological infrastructure. The customer first provides a category 2 factor, such as a password previously defined with the institution. The bank then sends a second code to the registered contact method, which may now include SMS, and the customer enters that code to finish authentication.
Operations Covered by the New Rules
The provisions apply to opening level 2 accounts and transfers associated with those accounts, as well as balance and transaction inquiries for products contracted through these channels. They also cover loans of up to 3,000 UDIs and payments for goods and services conducted through technology-based commission agents. These intermediaries act on behalf of banks using their own applications or websites.
Simpler Authentication for Low-Risk Inquiries
For balance and transaction inquiries, the CNBV introduced a differentiated treatment that reduces user friction and simplifies access. Banks may validate the client's identity using only the category 2 factor, without requiring a category 3 code sent to a contact channel. This approach recognizes the lower risk of informational requests compared with transactions that move funds, open accounts, or grant credit.
Updating Contact Information
Clients must be able to update their category 2 factor and the contact method used for category 3 delivery. The commission agent's website or application must provide an explicit, clear, and visible link that directs users to the bank's technological infrastructure. This ensures clients can modify their registered mobile number or preferred channel when their circumstances change.
Industry Impact and Compliance Considerations
The technology-based commission agent figure has been part of Mexican banking regulation since July 2024. The new rules require banks and fintech platforms to review contracts and authentication systems, with noncompliance potentially leading to CNBV observations and sanctions. At the same time, SMS delivery can support financial inclusion in areas with limited internet access or email use, aligning with broader inclusion policy goals.
The CNBV adjustment modernizes authentication for banking services delivered through third-party digital platforms while maintaining risk-based safeguards. By permitting SMS delivery and simplifying balance checks, the regulator seeks to improve access for users who may have limited connectivity to other channels. Banks, technology intermediaries, and clients should update their processes, contracts, and contact information to benefit from the new framework.