MEXICO Law and Practice Contributed by: Alejandro Mendiola Diaz and Gunter A. Schwandt G, Nader Hayaux & Goebel
mitigate risks in the rapidly growing digital financial services sector. • General Provisions Applicable to Credit Institutions ( Disposiciones de Carácter General Aplicables a las Instituciones de Crédito ). Issued by Banxico and the National Banking and Securities Commission (CNBV), these impose strict standards on banks and financial institutions, requiring risk manage - ment frameworks, security controls, incident response mechanisms, and safeguards for cus - tomer data and transactions. • Circular 8/2019 (and related updates). Issued for participants in Mexico’s Interbank Electronic Pay - ments System (SPEI), this regulation enhances cybersecurity through requirements for encryption, strong authentication, real-time monitoring and fraud prevention in real-time payments. • Principles for Strengthening Cybersecurity to Ensure Financial System Stability ( Principios para reforzar la seguridad de la información en el sis- tema financiero ). These represent best practices and regulatory guidelines from financial authorities (eg, Banxico and CNBV) to promote risk-based cybersecurity resilience in the financial sector. • Mexican Official Standards ( Normas Oficiales Mexicanas , NOMs). Several NOMs provide manda - tory requirements for cybersecurity and information protection, including: (a) NOM-151-SCFI-2016 ( Requisitos que deben observarse para la conservación de mensajes de datos y digitalización de documentos ), which remains in force (with a proposed modi - fication discussed in 2021 but no major repeal or full replacement noted as of 2026), regulat - ing the preservation of digital data messages and digitisation to ensure electronic documents remain authentic, reliable and unaltered; criti - cal for cybersecurity, e-commerce, and legal compliance; and (b) NOM-004-SSA3-2012. This establishes criteria for the creation, management, and conserva - tion of medical records, reinforcing data pro - tection, confidentiality and security in health - care services. The Agency for Digital Transformation and Telecom - munications (ATDT), established in 2024, leads federal cybersecurity policy through its General Directorate of
Cybersecurity, as provided in its organic structure and regulatory framework. In 2025, the ATDT published the National Cyberse - curity Plan 2025–2030, Mexico’s first unified national cybersecurity policy framework. The Plan aims to strengthen national cyber resilience, coordinate fed - eral incident response, and position Mexico as a regional leader in cybersecurity. The Plan contemplates, among its strategic com - ponents, promoting the presentation of a General Cybersecurity Law to Congress as part of the national framework. Given these ongoing developments, it will be crucial to monitor how these regulations evolve, particularly the potential enactment of a dedicated cybersecu - rity law and the full implementation of the 2025–2030 Plan. The government’s reforms and new entities may significantly reshape enforcement, coordination, and sector-wide cybersecurity policies in the coming years. 1.3 Cybersecurity Regulators Cybersecurity regulation in Mexico is fragmented across various government agencies, primarily due to the absence of a comprehensive legal framework and a central authority with broad oversight respon - sibilities. As a result, multiple entities assume roles in cybersecurity, each focusing on distinct areas such as law enforcement, the financial sector and data protec - tion. The landscape is continually evolving. Law Enforcement and Cybercrime Investigation The Attorney General’s Office ( Fiscalía General de la República , FGR) and local prosecutors’ offices play a central role in investigating cybercrimes. The Fed - eral Criminal Code defines various offences, includ - ing unauthorised access to information systems, data breaches, and the illegal disclosure of sensitive infor - mation. Cybercrime investigations often involve coor - dination between various state and federal authorities. In Mexico City, the Cybercrime Investigation Unit with - in the local prosecutor’s office specialises in investi - gating digital offences. These include crimes against sexual privacy, such as the unauthorised sharing of
248 CHAMBERS.COM
Powered by FlippingBook