Mexico VASP registration & AML compliance.
A compliance-led pathway for non-financial businesses providing virtual-asset exchange, custody, storage, or transfer services through electronic platforms.
“VASP licence” is market shorthand—not the legal name of a single Mexican licence.
For many non-financial crypto operators, the core route is registration and ongoing compliance as a person conducting a Vulnerable Activity. Regulated banks and fintech institutions sit within a separate Banxico/CNBV perimeter.
Covered services
Habitual and professional exchange, purchase/sale facilitation, custody, storage and transfer of virtual assets through electronic, digital or similar platforms.
Cross-border reach
The 2025 wording expressly includes covered operations conducted with Mexican citizens from another jurisdiction, increasing the importance of customer-location and solicitation analysis.
UMA-based notices
Transaction and service-fee notice thresholds are expressed in UMA, not fixed pesos. Current annual UMA values and aggregation rules must be applied operationally.
Separate financial perimeter
Banks and authorized financial-technology institutions face distinct rules, including Banxico Circular 4/2019 for internal virtual-asset operations subject to prior authorization.
What a launch-ready VASP framework should contain.
Final requirements depend on the current secondary rules and the specific platform, but the following workstreams form the practical foundation.
Registration file
Entity, RFC, beneficial ownership, registered activity, compliance representative, portal registration and supporting corporate evidence.
Risk assessment
Document products, assets, customer profiles, geographies, delivery channels, counterparties, wallet exposure and transaction risks.
AML policy manual
Customer due diligence, enhanced due diligence, beneficial-owner verification, PEPs, sanctions, source-of-funds and escalation procedures.
Monitoring & notices
Automated or system-assisted monitoring, UMA threshold logic, six-month accumulation analysis, unusual activity escalation and statutory notices.
Originator / recipient data
Operational capture and retention of precise originator, recipient and beneficial-controller information for covered virtual-asset transfers.
Records, training & audit
Ten-year record retention, staff selection and annual training, internal controls, compliance evidence and route-specific audit readiness.
How the engagement works.
Business-model and perimeter review
Confirm exchange, brokerage, custody, wallet, transfer and settlement functions, customer countries and whether any financial-institution route is implicated.
Company and registration prerequisites
Coordinate the Mexican entity, corporate purpose, tax registration, beneficial ownership, local records and compliance-responsibility structure.
Policies, systems and evidence
Build the AML/KYC framework, monitoring logic, notice calendar, information capture, privacy materials and operating procedures.
Registration and ongoing operation
Prepare the portal submission and supporting materials, then coordinate reporting, training, records, updates and continuing compliance.
Mexico VASP questions.
For many non-financial operators, the relevant pathway is registration and AML compliance as a Vulnerable Activity rather than a prudential financial licence. Regulated banks and fintech institutions are subject to separate rules.
The July 2025 reform expressly includes qualifying virtual-asset services conducted with Mexican citizens from another jurisdiction. The facts of solicitation, onboarding, service delivery and customer location must be reviewed.
Not merely through vulnerable-activity registration. Wallets denominated in fiat or electronic payment funds, customer payment accounts, and broader payment functions may require an IFPE or another regulated structure.
We support banking and payment-partner readiness, documentation, compliance positioning and onboarding coordination. Approval remains subject to each institution’s risk appetite and due diligence.
Map the Mexico perimeter before building.
Send the exchange, custody, wallet and transfer functions, customer markets, asset types, settlement model and banking requirements.