On September 8, 2026, the Mexican President submitted to Congress a bill to enact a Ley de Economía Digital para Pagos Digitales y Electrónicos (the "Bill"). The Bill is a short framework law. It recognizes the CURP Digital and the Expediente Digital Ciudadano as mechanisms for the digital contracting of financial services, grants Banco de México and the CNBV new powers over point-of-sale acceptance and the design of financial applications and authorizes the Ministry of Finance (SHCP) to designate sectors in which digital payment may become the only accepted form of payment. It contains no sanctions, no dates and no named sectors. Those elements are reserved for secondary regulation, to be issued within short deadlines after entry into force.
The Bill has not been discussed in committee, requires approval by both chambers of Congress and may be amended before publication. This alert summarizes the text as submitted and identifies the points on which financial institutions, acquirers, fintechs and merchants in targeted sectors may wish to focus while the Bill is under review.
Background
The Bill gives statutory form to the payments-digitalization strategy that the federal government has been advancing since April 2026, which contemplated a gradual move away from cash, beginning with gasoline stations and toll roads. It was delivered to Congress with two other bills on customs and on cadastral and registry harmonization.
The explanatory memorandum for the Bill relies on INEGI's 2024 National Financial Inclusion Survey (ENIF). Between 2021 and 2024, cash as the most frequent means of payment for purchases of MXN 500 or less fell from 90.1% to 85.2%, while electronic transfers and mobile applications rose from 1.6% to 4.4%. Adoption is uneven: close to 10% of respondents in Mexico City reported the mobile phone as their most frequent means of payment, against 6% in the southern region. The President's position is that Mexico's payments infrastructure (SPEI, CoDi, Dimo, tiered account levels and mobile penetration exceeding that of the banking system) is sufficient and that the gap lies in adoption. The Bill is presented as the legal framework required for that transition, together with generalized acceptance of digital payments and identity mechanisms that allow remote processes.
What the Bill proposes
Structure and scope
The Bill does not displace financial, commercial banking and securities statutes and regulations.
Two definitions determine its reach. "Entidades" are banks, SOFOMs, SOFIPOs, SOFINCOs, SOCAPs and financial entities acting as trustees of trusts that extend credit to the public, uniones de crédito, fintech institutions (ITFs) and any company that habitually extends credit, loans or financing to the public. "Proveedores de Bienes o Servicios" are public or private persons that habitually and professionally carry out commercial transactions. "Medios de Pago Digitales y Electrónicos" include QR codes, NFC devices, debit and credit cards, fund transfer orders including direct debit, any device, card or interface enabling payments or transfers and any other means recognized by the competent authorities. The definition broadly tracks the concept of "medios de disposición" (payment instruments) in Article 3, section XII of the Ley para la Transparencia y Ordenamiento de los Servicios Financieros.
Mechanisms for the contracting of financial services
Title Two is the part of the Bill with the most direct effect on financial institutions:
- CURP Digital. In the digital contracting of financial services, the CURP Digital provided for in Articles 91 Bis and 91 Quinquies of the Ley General de Población would be accepted as a verification mechanism (mecanismo de confianza) in accordance with the implementing regulations to be issued by the competent authorities and without prejudice to any other mechanism those authorities enable (Article 5). Users would be free to use, at their election, the CURP Digital or any other official identification (Article 6).
- Expediente Digital Ciudadano. The Expediente Digital Ciudadano regulated by the Ley Nacional para Eliminar Trámites Burocráticos is the digital file in which the government holds documents and information already provided by a person so that they need not be resubmitted for each administrative procedure. Under the Bill it would become a verification mechanism for the consultation or use of a user's documents and information, which subject financial entities and lenders would be required to accept in the contracting of and access to financial services whenever the user so requests (Article 7). Users could request consultation and portability of the documents and information held in the file for purposes of digital contracting (Article 8). Digital documents in the file would have the same legal effects that the law grants to physical documents issued in accordance with applicable regulation (Article 9). Article 22 confirms that the file is to exist for both individuals and legal entities.
The explanatory memorandum of the Bill conditions both mechanisms on the consent of the data subject and on compliance with personal data protection legislation.
Digital payment means and digital-only sectors
Authorities at the federal, state and municipal level would be required to take the actions necessary to accept digital payment means for administrative procedures and services (Article 10). Private providers of goods and services "may" implement them (Article 11); the Bill does not impose a general acceptance obligation on the private sector. Where digital payment means are implemented, providers and authorities would be expected to enable the necessary infrastructure, inform users of the means enabled, address contingencies and promote use (Article 12).
The SHCP would determine the "strategic sectors and relevant activities" in which acceptance of digital payment means "may be the only form of payment" (Article 13). The primary regulator for each such sector would then issue general regulations establishing the conditions, requirements, obligations and operating rules for the receipt of digital payments as the only form of payment and could set specific mechanisms and deadlines for a gradual transition from cash (Article 14). Cash or cheque would have to be accepted whenever a contingency, defined as an extraordinary, unforeseen or unavoidable event of force majeure that temporarily affects digital infrastructure, prevents digital payments (Article 15). Contingencies could not justify non-compliance on a permanent or recurring basis (Article 16).
Powers of Banco de México and the CNBV
Banco de México "may" take the following actions:
Expand the operating levels of demand deposit accounts to create alternatives adapted to the needs of the population.
- Issue regulations establishing the homologation of the user experience of financial services applications.
- Issue general regulations jointly with the CNBV and under the CNBV's supervision, requiring subject financial entities and lenders that provide card acceptance through point-of-sale terminals to also accept digital payments through QR codes, in accordance with technical and operational specifications issued by Banco de México.
- Establish measures or provide infrastructure to facilitate the population's access to financial services.
Separately, competent authorities would be required to issue general provisions removing barriers to financial inclusion in the granting of credit and financing (Article 17) and to carry out connectivity plans that support implementation (Article 18).
Obligations of financial entities
Subject financial entities and lenders are required to promote financial inclusion, publicize the products and services they offer to different segments of the population, promote the tiered account levels, facilitate the granting of credit and financing through digital means and comply with any other obligations established in applicable law, in each case in accordance with general provisions issued by the competent authorities. As drafted, these are programmatic duties whose content will depend entirely on secondary regulation.
Administrative procedures and technological solutions
Authorities at the three levels of government are required to adopt the homologated models for economic-development procedures and the technological solutions developed by the Agencia de Transformación Digital y Telecomunicaciones under the Ley Nacional para Eliminar Trámites Burocráticos (Articles 21 and 22). The solutions named are the CURP Digital, the Expediente Digital Ciudadano for individuals and legal entities, the Ventanilla Digital Nacional de Inversiones, the Plataforma de Establecimientos Mercantiles and any others such Agency determines.
Entry into force and transitional deadlines
The decree would enter into force the day after its publication in the Diario Oficial de la Federación. Within 15 business days of entry into force, the SHCP would have to issue its determination of strategic sectors and relevant activities, which it could later expand. Within a further 15 business days from publication of that determination, the competent sectoral authorities would have to issue the general regulations establishing the conditions, requirements, obligations and operating rules for the receipt of digital payments, including transition mechanisms and deadlines. No additional budget would be authorized.
Practical implications
The Bill's brevity is deliberate. Its effect on any given institution will be determined by the SHCP designation, the sectoral rules and the Banco de México and CNBV provisions that follow. Even so, the text as submitted allows a number of points to be identified now.
- Interaction with the onboarding and KYC framework. The CURP Digital and the Expediente Digital Ciudadano would be added to, rather than substituted for, the existing identification regime. Article 6 preserves the user's choice of identification, and Article 5 defers to general regulations to be issued by the competent authorities. How these mechanisms are integrated with the CNBV's rules on non-face-to-face account opening and with customer identification obligations under anti-money laundering regulation will be determined in those regulations. Institutions should expect adjustments to remote onboarding flows, identity verification vendors and record-keeping and may wish to engage with the CNBV and the SHCP on the design of the rules.
- Legal value of digital documents. Article 9 gives documents in the Expediente Digital Ciudadano the same legal effects as physical originals. Read together with the portability right in Article 8, this would allow a customer's documentation to be sourced from a government-held file at the customer's request. The practical questions are evidentiary and operational: how an institution evidences that a document was obtained from the file, how it is refreshed and how it is treated in the customer's file for supervisory purposes.
- Breadth of the "Entidades" definition. The definition captures unregulated lenders ("sociedades que de manera habitual otorguen créditos, préstamos o financiamientos al público"), which brings non-supervised SOFOMs and other lenders within the scope of Articles 7 and 20. The Bill does not identify which authority would issue rules for or supervise those entities.
- QR acceptance at point of sale. The joint Banco de México and CNBV power in Article 19, section IV, would require acquirers offering card terminals to accept QR payments under Banco de México's specifications. This should be read alongside the draft Payment Networks Rules submitted to CONAMER by the CNBV and Banco de México on August 26, 2026, which already propose interchange caps, universal interoperability across clearing houses and a full regulatory regime for aggregators. The two instruments address the same acquiring market and are likely to be implemented in parallel.
- Homologation of application design. The power to standardize the user experience of financial applications is new and broadly worded. Its scope, whether it extends to navigation, disclosures, authentication or visual design and how it coexists with existing security and transparency rules, will only be known when Banco de México issues the corresponding rules.
- Digital-only sectors and merchant clients. For financial institutions, the sectoral designation matters mostly through their merchant and corporate clients. Businesses in a designated sector will need acquiring, collection and reconciliation capabilities in place before their sector deadline, together with documented contingency procedures that satisfy Articles 15 and 16. Institutions serving fuel retail, highway concessions, transport and public services should anticipate demand for these services shortly after the SHCP determination.
- Absence of a sanctions regime. The Bill contains no penalties. Enforcement of the digital-only mandate would rest on the sectoral regulators and on whatever consequences their own legal frameworks attach to breach of general regulations. This gap may be addressed in committee.
- Data protection. Both trust mechanisms involve government-held identity data and documentation being consulted by financial institutions. The Bill refers to consent and to personal data protection legislation but does not itself regulate access, purpose limitation or retention. Those rules will need to be reconciled with the Ley Federal de Protección de Datos Personales en Posesión de los Particulares and with financial secrecy regulations.
Legislative outlook
The Bill was received by the Chamber of Deputies on September 8, 2026. It will be referred to committee. Because it arrived with the Economic Package, it may move on a compressed timetable, although it is not part of the revenue law and is not subject to the constitutional deadlines that apply to the budget. If approved by both chambers without substantive change and published promptly, the transitional provisions would produce an SHCP designation of sectors and a first set of sectoral rules within approximately 30 business days of publication.
Conclusion
The Bill does not, by itself, change any obligation of a financial institution or any merchant. What it does is create the legal basis for three developments: mandatory acceptance of government-issued digital identity and documentation in remote financial contracting; central bank authority over the acceptance infrastructure and the design of financial applications; and sector-by-sector elimination of cash under rules to be written by the SHCP and the sectoral regulators. The substance of each will be decided in secondary regulation on short deadlines. Institutions with an interest in how those rules are written have a window to engage while the text is in committee and, once it is enacted, during the 30-business-day period in which the SHCP and the sectoral authorities are required to act.
We will continue to monitor the Bill and the related draft provisions on card payment networks and will report on developments.
White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.
This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.
© 2026 White & Case LLP
