up:: The Mandates MOC
CNBV and Banxico (Mexico)
The Comisión Nacional Bancaria y de Valores (CNBV) is Mexico’s banking and securities supervisor and Banco de México (Banxico) is its central bank, and together they write the cybersecurity rules that bind Mexican credit institutions, SPEI payment-system participants and the fintech sector. Their framework requires encryption, mandates asymmetric cryptography on specific channels, and runs the country’s own certificate authority infrastructure. It names a specific cryptographic algorithm in exactly one instrument, which Banxico last amended in 2010, and as of September 2026 it carries no post-quantum position of any kind. That combination makes Mexico a useful worked example of a mature cybersecurity regime whose cryptographic layer is specified by category rather than by instance.
The short version:
- Mexican financial cybersecurity regulation is substantial, with a mandated CISO, a board-visible security master plan, quarterly vulnerability scanning, twice-yearly independent penetration testing and immediate incident reporting to the supervisor.
- It requires encryption “conforme al grado de sensibilidad o clasificación que la Institución determine,” so the algorithm is entirely at the institution’s discretion.
- Across eight primary documents totaling 601,532 words, the vocabulary of quantum computing and quantum-resistant cryptography appears zero times.
- The only named cryptographic primitives in the whole set are RSA PKCS#10 as a certificate-request format and SHA-1, both in Banxico’s Circular-Telefax 6/2005, whose most recent amendment is dated August 2, 2010.
- Mexico is not a G7 member, so the G7 CEG roadmap does not reach it through membership. Banco de México is a BIS member central bank, and the BIS published its own quantum-readiness roadmap for the financial system in July 2025.
Think of it like a building code that requires every door to have a lock, specifies how often the keys must be reissued, and never says what kind of lock. Every building in the country is locked, the inspections are real, and nobody holds a list of which locks are the ones that a new tool opens.
What does Mexican regulation require on cryptography?
Four instruments carry the cryptographic requirements, and each one specifies a category rather than an algorithm.
| Instrument | Currency | What it says about cryptography |
|---|---|---|
| CNBV, Disposiciones de carácter general aplicables a las instituciones de crédito (the CUB) | DOF Dec 2, 2005, consolidated through Sept 1, 2026 | Defines Cifrado and Criptografía Matemática Asimétrica; requires encryption calibrated to a sensitivity classification the institution sets; names no algorithm |
| Banxico, Circular 14/2017 (SPEI rules) | published July 4, 2017, compiled through Circular 9/2026 | Requires interconnection links secured “mediante protocolos y algoritmos de cifrado de datos”; requires SPEI operators to hold a valid Certificado Digital |
| Banxico, Circular-Telefax 6/2005 (IES rules) | issued Mar 15, 2005, last amended Aug 2, 2010 | Anexo 3 requires RSA PKCS#10 request format and derives a challengePassword with SHA-1; Anexo 4 requires ITU-T X.509v3 and caps certificate validity at 4 years |
| CNBV, Disposiciones aplicables a las instituciones de tecnología financiera | DOF Sept 10, 2018, amended through July 6, 2026 | Mirrors the CUB; Article 87 additionally requires outsourcing documentation to record “la versión de los protocolos de Cifrado” |
The CUB’s definition of asymmetric cryptography is worth reading closely, because it describes precisely the class that Shor’s algorithm breaks. Article 1, fracción XLIV Bis defines Criptografía Matemática Asimétrica as encryption methods using a public and private key pair “relacionadas matemáticamente de tal forma que la información Cifrada con una de las llaves solo puede ser descifrada con la llave asociada.” RSA and elliptic-curve cryptography are the production instances of that family. The CUB names the family, requires its use on the channel between institutions and their banking commissioners, and never revisits the question.
Sources: CNBV, “Disposiciones de carácter general aplicables a las instituciones de crédito,” consolidated text through September 1, 2026, Article 1 fracciones XXXI and XLIV Bis, cnbv.gob.mx; Banco de México, “Circular 14/2017, Reglas del Sistema de Pagos Electrónicos Interbancarios,” compiled text, banxico.org.mx.
What is the CNBV information-security regime?
The CUB’s information-security rules live in Título Quinto, Sección Octava Bis, “De la seguridad de la información,” added by the resolution published in the Diario Oficial de la Federación on November 27, 2018 and running from Article 168 Bis 11 to Article 168 Bis 17. The regime is genuinely demanding, and several G7 jurisdictions do not require all of it of every regulated bank.
| Provision | Requirement |
|---|---|
| Art. 168 Bis 11, fr. II | A documented, detailed inventory of every component of the Technological Infrastructure, with its changes and updates |
| Art. 168 Bis 11, fr. VI, b) | Encryption of information in transit, in storage and on remote access, at a sensitivity grade the institution determines |
| Art. 168 Bis 11, fr. VI, c) | Access credentials changed every 90 days or less; application-to-application credentials at least annually |
| Art. 168 Bis 11, fr. X | Annual capacity exercises, plus obsolescence evaluation of infrastructure components and a plan to update them |
| Art. 168 Bis 12, fr. I | A Plan Director de Seguridad approved by the CEO, reported to the Board with evidence of implementation |
| Art. 168 Bis 12, fr. III | An annual vulnerability-scanning calendar with quarterly coverage, prioritized by the Article 86 information classification |
| Art. 168 Bis 12, fr. IV | At least two penetration tests a year by a certified independent third party, results to the CNBV within 20 business days |
| Art. 168 Bis 13 | A CISO appointed by the CEO, at the level immediately below, reporting directly, with no conflict of interest against IT, audit or the business units |
| Art. 168 Bis 16 | Immediate incident notification to the CNBV, annexes within 5 business days, client notification within 48 hours where sensitive information was taken |
| Art. 168 Bis 17 | An incident, fault and vulnerability register retained “por, al menos, 10 años” |
Source: CNBV, “Disposiciones de carácter general aplicables a las instituciones de crédito,” Título Quinto, Sección Octava Bis, cnbv.gob.mx.
Two structural features of that regime matter for the post-quantum question.
The inventory in Article 168 Bis 11, fracción II is a technology inventory rather than a cryptographic inventory. It covers components, configurations, changes and updates. A cryptographic inventory answers which algorithms and key lengths are in use, where, protecting what, and with what vendor dependency, which is a different artifact built from different data. The G7 CEG roadmap makes it a distinct phase 2 outcome for that reason, and the BIS calls it a critical foundation.
The obsolescence duty in fracción X reaches components rather than primitives. Hardware and software age out and get an update plan. A cryptographic algorithm ages on a different clock, and a system can be running on fully current, vendor-supported, patched components while the algorithm inside it is the thing that fails. Nothing in the CUB requires anyone to check that second clock.
Does Mexico have a post-quantum position?
No, as of September 4, 2026, in the eight primary documents that make up the financial-sector framework.
The claim is a negative, so it is worth stating how it was produced rather than asserting it. Each document was fetched, converted to plain text, and searched for two term families: the vocabulary of quantum risk (cuántica, poscuántica, quantum, post-quantum, Shor, Grover, and the Spanish phrasings of quantum-resistant cryptography) and the names of specific cryptographic algorithms. Accents were folded before matching, so accented and unaccented spellings both count.
| Document | Words | Quantum terms | Algorithm names |
|---|---|---|---|
| Banxico, Estrategia de Ciberseguridad 2024–2027 | 4,626 | 0 | 0 |
| Banxico, Circular 8/2019 | 18,217 | 0 | 0 |
| Banxico, Circular 14/2017 compiled (SPEI rules) | 90,938 | 0 | 0 |
| Banxico, Circular-Telefax 6/2005 compiled (IES rules) | 7,528 | 0 | 3 |
| CNBV, Disposiciones aplicables a las instituciones de crédito | 376,471 | 0 | 0 |
| CNBV, Disposiciones aplicables a las ITF | 39,243 | 0 | 0 |
| CNBV, Disposiciones aplicables a las IFPE | 22,858 | 0 | 0 |
| Ley para Regular las Instituciones de Tecnología Financiera | 41,651 | 0 | 0 |
| Total | 601,532 | 0 | 3 |
All 3 algorithm occurrences are in Circular-Telefax 6/2005: 1 reference to “el estándar RSA PKCS#10” as the certificate-request format, and 2 references to SHA-1 in the challengePassword derivation and its footnote.
⚠️ An absence in this set is an absence in this set. The search covers the eight documents above. It does not cover CONDUSEF provisions, the anti-money-laundering regime, CNSF insurance provisions, CONSAR pension provisions, sub-annexes published separately from the consolidated texts, or non-public supervisory communication.
Banxico’s own cybersecurity strategy is the document where a position would most naturally sit, and three features of it are worth stating.
- It is structurally current. The Estrategia de Ciberseguridad del Banco de México 2024–2027 sets 10 strategic objectives and maps every strategic action to the 6 functions of the NIST Cybersecurity Framework 2.0. Objectives BM-1 and SF-1 both commit the Bank to issuing and updating cybersecurity provisions “con base en estándares y principios internacionales,” and strategic action 9 repeats the commitment operationally.
- It is specific about emerging technology. The threat-environment section enumerates 5 groups of threat actors, singling out those “que emplean la Inteligencia Artificial para engañar, defraudar, usurpar o cometer otro tipo de delito.” Artificial intelligence is named as an adversary capability.
- It contains no cryptographic vocabulary at all. Across the full 4,626-word document, the words criptografía, cifrado, algoritmo and llave do not appear once, and quantum computing is not among the threats named.
Source: Banco de México, “Estrategia de Ciberseguridad del Banco de México 2024–2027,” Uso Público, banxico.org.mx. The document carries no publication date beyond the span in its title.
What is the Infraestructura Extendida de Seguridad, and why does it matter?
The Infraestructura Extendida de Seguridad (IES) is Banco de México’s own public-key infrastructure, and it is the trust anchor underneath SPEI, Mexico’s real-time gross settlement system. Circular 14/2017, Regla 1a fracción VII defines Certificado Digital by reference outward to the rules for operating as a registration or certification agency in the IES, which are contained in Circular-Telefax 6/2005. Every SPEI operator must hold a valid Certificado Digital, and formal communications to the system administrator must be signed with one.
Circular-Telefax 6/2005 was issued on March 15, 2005, amended by Circular-Telefax 6/2005 Bis on December 23, 2005 and by Circular 23/2010 on August 2, 2010. Banxico’s normative index lists credit institutions as the obliged parties and records no amendment after 2010.
Its two technical annexes are the certificate profile:
- Anexo 3, on certificate requests. “El formato del requerimiento de un Certificado Digital deberá cumplir con el estándar RSA PKCS#10.” The request carries a distinguished name at specified OIDs, the electronic-signature verification data, and a challengePassword at OID 1.2.840.113549.1.9.7, derived by concatenating the holder’s tax ID with a secret phrase, applying “el algoritmo de digestión SHA1,” and filtering through Base64. Footnote 15 cites RFC 3174 for SHA-1.
- Anexo 4, on the certificates. “El formato del Certificado Digital deberá apegarse a la especificación ITU-T X.509v3.” The certificate carries a 20-digit identifier, the issuing agency’s identity and electronic signature, the holder’s identity and verification data, and, since Circular 23/2010, a validity period not exceeding 4 years.
Source: Banco de México, “Circular-Telefax 6/2005, Reglas para operar como Agencia Registradora y/o Agencia Certificadora en la Infraestructura Extendida de Seguridad,” compiled text, Anexos 3 and 4, anterior.banxico.org.mx; amendment history at banxico.org.mx.
Three precise observations follow.
The rules specify no key length. The words bits, longitud, 1024 and 2048 do not appear in the document. They also specify no signature algorithm for the certificate itself, so the profile is X.509v3 and the choice of what signs it is left open.
The SHA-1 use is narrow, and overstating it would be wrong. It derives a challengePassword inside a certificate request, so the property it depends on is preimage resistance rather than collision resistance, and the 2017 SHAttered collision does not directly break that construction. What the fact establishes is the maintenance record: the one cryptographic primitive written into the identity rules for Mexico’s RTGS was named in 2005, has not been revisited since 2010, and is an algorithm NIST retired on December 15, 2022 and disallows for federal use after December 31, 2030.
The 4-year validity ceiling is the most interesting operational detail in the whole framework. Every certificate in the IES estate reissues at least twice before 2035, which means the moment at which an algorithm choice gets made is already in the operating calendar, whether or not anyone treats it as a decision.
Source: NIST, “NIST Retires SHA-1 Cryptographic Algorithm,” December 15, 2022, nist.gov.
Does the G7 roadmap apply to Mexican institutions?
Not by its own terms and not through membership. The G7 CEG statement of January 2026 says in its own text that it “does not set guidance or regulatory expectations,” and Mexico is not a G7 jurisdiction.
Three connections reach Mexican institutions anyway, and each is structural.
- The roadmap’s stated audience runs past the supervised firm. It names financial authorities, financial entities, providers of critical services, cryptographic and security technology vendors, infrastructure operators, national cyber agencies and standard-setting bodies. An institution that clears, settles or correspondents through a G7 jurisdiction sits inside that audience by virtue of who it transacts with.
- Third-party dependency is treated as a first-order problem. The CEG notes that financial institutions are “often highly dependent upon and interconnected with information technology products, vendors and other third-party providers,” and names limited vendor-roadmap transparency as a planning barrier, particularly for “smaller institutions with higher levels of vendor dependency.” A vendor questionnaire generated by a G7 bank’s inventory reaches its suppliers wherever they are incorporated.
- Banco de México belongs to the BIS. The Bank of Mexico appears on the BIS list of member central banks, and in July 2025 the BIS published Quantum-readiness for the financial system: a roadmap as BIS Papers No 158, which emphasizes “the need to start the transition today, with broad awareness and cryptographic inventory as critical foundations.” The sector-level expectation predates the G7 statement by 6 months and arrived through a body Mexico sits inside.
Sources: G7 Cyber Expert Group, “Advancing a Coordinated Roadmap for the Transition to Post-Quantum Cryptography in the Financial Sector,” January 2026, treasury.gov; BIS, “Quantum-readiness for the financial system: a roadmap,” BIS Papers No 158, July 2025, bis.org; BIS, “BIS member central banks,” bis.org.
How does the framework’s data classification interact with harvest-now-decrypt-later?
They run on different axes, and the mismatch is visible in the provision’s own wording.
Article 86, fracción III, inciso b), numeral 3 of the CUB requires institutions to establish policies for classifying information and its treatment “de acuerdo con el riesgo que implique que la seguridad de la información sea vulnerada,” which is breach severity. That is the correct axis for nearly every threat, because nearly every threat is realized at the moment of breach. Harvest now, decrypt later inverts it: exposure is set by how long the data must remain confidential after capture, which is a retention question. Mortgage files, beneficial-ownership records, KYC dossiers and long-dated derivative documentation can be modest-severity today and high-exposure across 20 years. The two axes produce different lists, and the framework only asks for one of them.
The framework also mandates a decade of retention on material it leaves the institution to protect at its own discretion. Article 168 Bis 17 requires the incident, fault and vulnerability register to be kept “por, al menos, 10 años,” backed up “en los medios que las Instituciones determinen.” That register describes detected attacks, exploited weaknesses, affected clients and amounts, held on media and under encryption entirely of the institution’s choosing.
Source: CNBV, “Disposiciones de carácter general aplicables a las instituciones de crédito,” Articles 86 and 168 Bis 17, cnbv.gob.mx.
Where does the Ley Fintech fit?
The Ley para Regular las Instituciones de Tecnología Financiera, published in the DOF on March 9, 2018 with its most recent reform published November 14, 2025, refers to information security 6 times, at Articles 39, 48, 58, 83 and 87, and contains no cryptographic vocabulary at all. Article 48 is the delegation: the CNBV issues general information-security provisions for crowdfunding institutions, and the CNBV and Banco de México issue them jointly for electronic payment funds institutions.
Both delegated instruments follow the CUB pattern. The ITF provisions, published September 10, 2018 and amended through July 6, 2026, define Cifrado in Article 2 fracción III in the CUB’s own words, and Article 63 mirrors Article 168 Bis 11 clause for clause. The IFPE provisions, published January 28, 2021, use encryption 15 times and name no algorithm.
One ITF provision is closer to a cryptographic inventory than anything else in Mexican law. Article 87, on outsourcing, requires the institution to hold documentation detailing the mechanisms securing encrypted transmission and storage, “incluyendo la versión de los protocolos de Cifrado y componentes de seguridad en la Infraestructura Tecnológica.” A protocol version, recorded per third party, is one field short of a vendor cryptographic inventory, and it already binds one class of Mexican institution.
Sources: “Ley para Regular las Instituciones de Tecnología Financiera,” DOF March 9, 2018, last reform DOF November 14, 2025, diputados.gob.mx; CNBV, “Disposiciones de carácter general aplicables a las instituciones de tecnología financiera,” cnbv.gob.mx.
Common misconceptions
“Mexico is behind on financial cybersecurity.” The regime is stronger than that reputation suggests. A mandated CISO with defined independence, a board-reported security master plan, quarterly vulnerability scanning, twice-yearly independent penetration testing, immediate supervisor notification and 48-hour client notification is more than several G7 jurisdictions require of every regulated bank. The gap covered here is specific to cryptography, and it is a gap of specification rather than of maturity.
“No post-quantum rule means Mexican banks cannot deploy post-quantum cryptography.” Nothing in the framework forbids it. The CUB requires encryption calibrated to a classification the institution sets, and Anexo 4 of the IES rules requires X.509v3, which ML-DSA certificates already use under RFC 9881. The rules are permissive by omission, which cuts both ways.
“The SHA-1 reference means SPEI is broken.” It does not. The SHA-1 use is a hash derivation of a challengePassword inside a certificate request, depending on preimage resistance rather than collision resistance, and the 2017 collision does not directly break it. The finding is about the maintenance record of a live rule, not about an exploitable weakness in SPEI today.
“The CUB inventory requirement covers cryptography.” Article 168 Bis 11, fracción II requires a detailed inventory of Technological Infrastructure components. That is a technology asset register. Which algorithms run inside those components, at what key lengths, protecting which data, is a separate artifact the framework never asks for.
“The G7 roadmap set a 2035 deadline for Mexican banks.” The roadmap set no deadline for anyone. It describes 2035 as a non-authoritative target range, offers 2030 to 2032 as a parenthetical example for critical systems, and states that it does not set guidance or regulatory expectations. Mexico is also not a G7 jurisdiction.
“Banxico’s cybersecurity strategy at least mentions cryptography.” The 2024–2027 strategy does not use the words criptografía, cifrado, algoritmo or llave anywhere in its 4,626 words. It names artificial intelligence explicitly as an emerging threat-actor capability and does not name quantum computing.
Questions people ask
Does any Latin American financial regulator have a post-quantum requirement? This note establishes the answer for Mexico only, from its eight primary documents, and that answer is no as of September 4, 2026. Extending the claim to the region requires the same document-by-document search against each country’s own primaries, which is the only way an absence claim is worth anything.
Which Mexican regulation actually names a cryptographic algorithm? One: Banco de México’s Circular-Telefax 6/2005, in Anexo 3, which requires the RSA PKCS#10 request format and derives a challengePassword using SHA-1. That circular was last amended on August 2, 2010.
What key lengths does Mexican regulation require? None. The words bits, longitud, 1024 and 2048 do not appear in the IES rules, and no other instrument in the set specifies a key length either.
Does the CNBV require a cryptographic inventory? No. Article 168 Bis 11, fracción II requires a detailed inventory of Technological Infrastructure components, which is an asset register rather than a record of algorithms, key lengths and their dependencies.
How long must Mexican banks retain incident records? At least 10 years, under Article 168 Bis 17 of the CUB, backed up on media the institution itself determines. The provision sets no encryption requirement for that archive beyond the general rule in Article 168 Bis 11.
Does Banco de México run its own certificate authority? It operates the Infraestructura Extendida de Seguridad, in which Banxico acts as the root registration authority and authorizes institutions to act as registration and certification agencies. The governing rules are Circular-Telefax 6/2005 as amended through Circular 23/2010.
How long is a Banxico IES certificate valid? No more than 4 years from issuance, under Anexo 4 §3.1 of Circular-Telefax 6/2005 as amended by Circular 23/2010.
Is Mexico covered by the G7 CEG roadmap? No. Mexico is not a G7 jurisdiction, and the roadmap states that it sets no guidance or regulatory expectations for anyone. Banco de México is a BIS member central bank, and the BIS published its own quantum-readiness roadmap for the financial system in July 2025.
Does the Ley Fintech say anything about encryption? No. It refers to information security 6 times and delegates the detail to the CNBV, and jointly to the CNBV and Banco de México for electronic payment funds institutions. The delegated provisions require encryption and name no algorithm.
Where would a Mexican post-quantum requirement most likely appear first? Banxico’s own strategy points at the mechanism: objective SF-1 commits the Bank to issuing and updating financial-sector cybersecurity provisions “con base en estándares y principios internacionales,” and strategic action 9 repeats it. The strategy runs through 2027.
Go deeper
- G7 Cyber Expert Group Quantum Roadmap, the January 2026 sector roadmap and what it declines to be
- Harvest Now, Decrypt Later (HNDL), the risk model the classification axis question turns on
- Cryptographic Discovery, what a cryptographic inventory is and how it differs from an asset register
- SHA-1, the retirement schedule and what the 2017 collision did and did not break
- US vs EU vs UK Post-Quantum Timelines, for how jurisdictions that have published timelines have structured them
The map is free. Doing the work inside a regulated institution, against its own supervisor’s language, is what I do at LaMarr Labs.
Last verified 2026-09-04 · Maintained by Addie LaMarr, LaMarr Labs.