The Ley de Economía Digital para Pagos Digitales y Electrónicos (Digital Economy Law for Digital and Electronic Payments) is the bill through which the Mexican government aims to expand the use of electronic payments and gradually reduce the role of cash in certain activities. The Chamber of Deputies passed it on 6 October 2026, and the bill now moves to the Senate, so it is not yet in force.
Most of the public debate has focused on cash, gas stations and toll booths. For banks and fintechs, the provision with the greatest operational impact sits elsewhere in the text: the article that recognises the CURP Digital as a trust mechanism for contracting financial services through digital channels. That is where I want to focus.
What is Mexico’s Digital Economy Law?
The Digital Economy Law for Digital and Electronic Payments is a public-order law that would apply throughout Mexico. Its purpose is to promote the adoption of electronic and digital payment methods. Its entry in the Sistema de Información Legislativo sums up the goal as closing “the gap between available infrastructure and its effective use”, so that anyone can pay digitally.
The federal Executive submitted it on 8 September 2026 alongside the reforms accompanying the Paquete Económico 2027, Mexico’s economic package for that year. It has mostly been read as a payments law, but much of the text deals with identity. It covers the CURP Digital, the Expediente Digital Ciudadano (the citizen’s digital file) and the rules for contracting financial services remotely.
Where does it stand? The legislative timeline
The bill has cleared the Chamber of Deputies, but several steps remain before it takes effect.
| Date | Milestone | What it means |
|---|---|---|
| 8 Sep 2026 | Federal Executive submits the bill to Congress | The legislative process begins |
| 9 Sep 2026 | Published in the Gaceta Parlamentaria | The official text becomes available for review |
| 2 Oct 2026 | Report approved by the Comisión de Hacienda y Crédito Público (Finance and Public Credit Committee) | Includes amendments to specific articles |
| 6 Oct 2026 | Passed by the full Chamber of Deputies | The bill is sent to the Senate |
| Pending | Senate debate | The Senate may approve, amend or return it |
| Pending | Publication in the DOF (Official Gazette) and entry into force | Deadlines start to run |
| Pending | SHCP (Ministry of Finance) defines strategic sectors (15 business days after entry into force) | First list of activities with digital-only payment |
For financial institutions, the timeline that matters starts after publication. The law sets out the what and leaves much of the how to the secondary regulations issued by the SHCP, Banxico, the CNBV and each sector’s authorities. Those regulations will define the technical requirements, the costs and the specific obligations.
The bill’s three key elements
Mexico’s Digital Economy Law rests on three pillars: making digital payment mandatory in certain activities, bringing the State’s digital identity into the contracting of financial services, and expanding the powers of payment regulators. The three are connected, because requiring digital payment only works if more people can open an account remotely. That is why, although public debate has centred on the first, the second is the one that most changes day-to-day work for a financial institution.
1. Mandatory digital payment in strategic sectors
The SHCP will be able to determine the sectors and activities in which digital payment is the only accepted form of payment (art. 13). Each sector authority will then set the conditions and timelines for the transition (art. 14). The government has mentioned gas stations and toll booths as a starting point. The law does not ban cash. Article 15 allows cash and cheques when a contingency prevents digital collection, and article 16 prevents that exception from being invoked on a permanent basis.
2. CURP Digital and Expediente Digital Ciudadano
The CURP Digital would be accepted as a trust mechanism for contracting financial services through digital channels, always at the user’s choice (arts. 5 and 6). The Expediente Digital Ciudadano would allow institutions to consult documents with the user’s authorisation. Those documents would have the same legal effect as their physical equivalents (arts. 7 to 9).
3. Broader powers for Banxico and the CNBV
Banxico will be able to raise the operating limits of demand deposit accounts, promote transfer tools and standardise the user experience of financial apps. Together with the CNBV, it will be able to require merchants that accept cards through point-of-sale terminals to also accept QR payments (art. 19). The underlying infrastructure will be SPEI and the CoDi and DiMo payment rails.
What the CURP Digital as a trust mechanism means for digital contracting
The text states that financial institutions will accept the CURP Digital as a trust mechanism for the digital contracting of financial services, in accordance with the provisions issued by the authorities. The next article adds that users may choose between the CURP Digital and any other official identification mechanism. We have already published a separate analysis of what the biometric CURP is and how to obtain it. My focus here is the legal role it would play in dealings with a bank.
The banking sector sees an opportunity in it. Emilio Romano, president of the Asociación de Bancos de México (ABM), Mexico’s banking association, described it in an interview as a virtual key that users open, close and update centrally. According to Romano, it would allow people to open accounts from their phones without the repeated checks against the INE that are part of the process today.
I share the view on reducing friction, but I see three nuances worth keeping in mind from the outset.
The first is that the customer chooses the flow. Because the CURP Digital coexists with other official IDs, institutions will have to maintain at least two onboarding paths, and both must offer the same level of assurance. In identity fraud, attackers always try the weakest door first.
The second concerns what the credential actually proves. A valid CURP Digital confirms that an identity exists and that its data is correct. The institution still needs to verify that the person presenting it is the holder, that they are present at that moment and that the capture has not been tampered with. My reading is that recognising it as a trust mechanism does not shift that responsibility away from the bank.
The third is the effect of concentration. The more value a single credential holds, the more attractive it becomes to fraudsters. Attacks then tend to shift from forging documents to taking control of the session or the device used to authorise access.
There is also a legal context that should not be overlooked. On 26 June 2026, the Twentieth Collegiate Court in Administrative Matters of the First Circuit published three tesis aisladas, non-binding judicial criteria, calling for enhanced protection against the mass, centralised collection of biometric data by public authorities. They are guidance rather than binding precedent. Even so, it is reasonable to expect that scrutiny to extend to how private institutions access and store that data.
What it means for banks and fintechs
| Provision | Impact on the institution | What to prepare |
|---|---|---|
| CURP Digital (arts. 5-6) | Accept it as a trust mechanism without dropping other official IDs | Parallel onboarding flows with the same level of biometric verification and liveness detection |
| Expediente Digital Ciudadano (arts. 7-9) | Consultation and portability of documents at the user’s request, with the same legal effect as physical ones | Consent records and traceability for every consultation |
| QR alongside POS terminals (art. 19) | New payment acceptance channels for merchants and acquirers | Monitoring of merchant onboarding and receiving accounts |
| Credit through digital channels (art. 20) | Obligation to facilitate loans and credit through digital channels | Stronger identity verification in remote loan origination |
The Expediente Digital Ciudadano follows a similar logic to the CURP Digital. If a digital document carries the same weight as a physical one, the risk lies less in checking the document and more in confirming that the person requesting its portability is its owner.
The law also arrives in parallel with the CNBV’s biometric reform (Anexo 71), whose compliance deadline falls between late October and early November 2026. Many institutions will be adapting their biometric infrastructure while the Senate debates this bill, and it makes sense to plan both fronts together. For the remote channel, the CNBV’s non-face-to-face identification requirements will remain the reference point until specific provisions on the CURP Digital are issued.
When the digital channel becomes mandatory, fraud goes digital too
During the floor debate, Deputy Emilio Suárez Licona (PRI) argued that the law does not address the prevention of fraud or other cybercrimes. Whatever one’s view of the legislative debate, the remark points to an operational problem that financial institutions know well.
The law will bring into the digital channel people who currently pay for almost everything in cash. Many have little experience with mobile banking and are more exposed to social engineering. It will also make it easier to open simplified accounts remotely, a product that money mule networks seek out precisely because of its low friction. On top of this come the attacks we already see in remote onboarding, such as deepfakes, tampered documents and injection attacks that replace the real camera feed with a fabricated video. All of them target the moment of account opening, which is why liveness detection and injection attack defence become baseline requirements. The pattern is not new in Mexico either. Impersonation of financial institutions in Mexico and the evolution of digital fraud in Mexico show how fraud adapts to every channel that gains users.
The ABM argues that reducing cash brings traceability and makes illicit activity harder. That traceability depends on the identity behind each account being real. A mule account is perfectly traceable to someone who is not the one moving the money. That is why verification at onboarding and ongoing account monitoring serve the same goal the law is pursuing.
How to prepare a financial institution for the Digital Economy Law
While the Senate debates the bill, there is work that does not depend on the final text and that fits with existing CNBV compliance obligations. Almost every point starts from a well-designed digital onboarding with biometric verification.
- Map digital onboarding flows and the products that could be contracted with the CURP Digital.
- Design the CURP Digital flow and the official ID flow with the same level of assurance.
- Keep biometric verification with liveness detection and injection defence in both flows.
- Record consent, Expediente Digital Ciudadano consultations and evidence of each onboarding for audit purposes.
- Review monitoring rules for simplified accounts opened remotely.
- Prepare a contingency plan for connectivity outages or failures in external validation services.
- Track the bill’s progress in the Senate and the provisions issued by the SHCP, Banxico and the CNBV.
FAQs
It is the bill that enacts the Ley de Economía Digital para Pagos Digitales y Electrónicos (Digital Economy Law for Digital and Electronic Payments), submitted by the federal Executive on 8 September 2026. It aims to ensure anyone can pay digitally and recognises the CURP Digital as a trust mechanism for contracting financial services through digital channels.
No. The Chamber of Deputies passed it on 6 October 2026 and the bill has moved to the Senate. It still needs Senate approval, publication in the Diario Oficial de la Federación (Mexico’s Official Gazette) and entry into force.
No. It allows the Ministry of Finance (SHCP) to designate strategic sectors where digital payment is the only accepted form of payment, with a gradual transition. It also keeps cash or cheques available when a contingency prevents digital payments from being received.
The SHCP would designate them within 15 business days of the law entering into force. The government has mentioned gas stations and toll booths as the first sectors.
The CURP Digital would be accepted as a trust mechanism for contracting financial services through digital channels. It is the user’s choice, as they can use either the CURP Digital or any other official ID.
No. Users choose between the CURP Digital and any other official identification mechanism, so institutions would have to accept both.
They should review their digital onboarding flows to accept the CURP Digital alongside other official IDs. They should also strengthen biometric verification with liveness detection and injection attack defence, document traceability and track the provisions issued by Banxico, the CNBV and the SHCP.
