Mexico's new regulatory framework for card payment networks

On August 27, 2026, Banco de México and the National Banking and Securities Commission (CNBV) announced the second public consultation of the draft General Rules Applicable to Payment Instrument Networks (the Draft Rules), aimed at updating the regulatory framework applicable to card payment networks in Mexico. Among its main pillars are strengthening interoperability between participants and networks, and revising the regime applicable to Interchange Fees.

The proposal comes amid heightened regulatory and antitrust scrutiny of the card payments market. In its recitals, the Draft Rules build on the findings of file IEBC-005-2018 of the Federal Economic Competition Commission (COFECE), which identified barriers in the domestic transaction-processing services provided by clearing houses. That precedent helps explain the paradigm shift underlying the new regulation: card payment networks stop being understood primarily as operational infrastructure built through relationships between private participants, and start being treated as an ecosystem subject to more comprehensive regulation, in which network access, interoperability, participation rules, costs, transparency and each participant's responsibilities become central elements of regulatory oversight.

This new approach represents a significant evolution from the current regime, based mainly on the General Rules Applicable to Payment Instrument Networks published on March 11, 2014 and their subsequent amendments (the 2014 Rules). The Draft Rules propose repealing that framework and replacing it with a more detailed regime governing the organization, operation and interaction of the different network participants, accompanied by transitory provisions designed to allow for a gradual implementation of the new scheme.

The Draft Rules define Card Payment Networks as Payment Instrument Networks related to the use of cards as a means of payment. Their architecture starts from a structural rule: each network must be integrated with a single Clearing House for Card Payments, together with issuers, acquirers, brand owners and, where applicable, aggregators and specialized companies (art. 16). Participants belonging to the same network must also agree to and observe the corresponding Terms and Conditions for Participation.

This definition matters because the regulation no longer merely identifies actors and functions. The Draft Rules determine how participants must integrate, how they may access the network, under what rules they must interact, and what responsibilities each one assumes. The Terms and Conditions must address, among other elements, rules on non-discriminatory access, interconnection, technical and operational standards, information security, business continuity, governance mechanisms, dispute resolution and procedures for technology updates (arts. 3 and 4).

The Issuer is the participant that issues the cards enabling cardholders to make payments within the networks (art. 2, § X). Within the transaction flow, it receives — directly or indirectly — the authorization requests originated at the merchant, decides whether to authorize or decline the transaction, and, when it authorizes it, becomes obligated to settle the corresponding amounts with the acquirer.

The Draft Rules require every issuer to connect to at least one Clearing House, either directly or through another issuer or a Specialized Company (art. 42). It must also process transactions regardless of which clearing house they come from, register its identification numbers with the clearing houses it connects to, and maintain controls to detect and prevent transactions that deviate from the cardholder's usual behavior (arts. 42 and 47).

Technology-related obligations are added on top of the above. Cards must comply with the certificates, security standards, technical rules and protocols set by brand owners (art. 43), and issuers must keep them updated on information security. Rolling out relevant new technologies must additionally be reported to the CNBV in advance through a work plan (arts. 45 and 46).

Finally, the issuer takes on a particularly significant economic role because it will be the party that sets Interchange Fees, subject to the caps, methodologies and registration procedures set out in the Draft Rules themselves (arts. 56 to 59 and 62). This economic dimension is developed further later in this analysis.

The Acquirer is the participant that provides Card Payment Services directly to payment recipients or to aggregators, and that supplies the POS terminal (TPV) infrastructure connected to the network (art. 2, § I). Operationally, it is the link between the merchant and the payment-processing infrastructure.

The Draft Rules require it to maintain a contractual relationship with at least one Clearing House (art. 29, § I). Through that clearing house it must route authorization requests, refunds and adjustments to issuers, and receive the authorizations, declines, chargebacks and other messages it later delivers to the payment recipient or aggregator.

The operational impact is considerable. Acquirers must provide POS terminals, accept authorization requests regardless of the card issuer, and settle funds with the payment recipient on the same calendar day the corresponding funds are received. In addition, they must segregate the accounts used for settlement from other contractual relationships and may not condition the delivery of funds on the purchase of other financial products or services (art. 31).

Their relationship with merchants is also subject to a greater degree of formalization: they must contractually set out fund-retention policies, dispute mechanisms, minimum operating standards and a breakdown of the Discount Rate (Tasa de Descuento) (art. 39), and must provide information on claims, chargebacks, refunds and fees (art. 40).

The Aggregator provides Card Payment Services to payment recipients, but does so under a contractual relationship with an acquirer (art. 2, § II). The legal model is therefore different: the aggregator does not connect directly to the clearing house as a condition of its activity; instead, it must maintain a contractual relationship with at least one acquirer and route the corresponding Card Payment Services messages through it (art. 30).

Despite that intermediation, the Draft Rules impose on the aggregator most of the obligations that otherwise fall on the acquirer vis-à-vis the merchant: delivering POS terminals, receiving authorization requests, settlement, account segregation, contractual transparency, risk controls and technology maintenance (arts. 31 to 36).

The regulation also more precisely limits how far its business model can extend. Art. 38 prohibits the aggregator from entering into contracts with third parties for the purpose of having those third parties provide Card Payment Services and POS terminals directly to payment recipients. This restriction will be particularly relevant for sub-aggregation, distribution or white-label models.

The Clearing House is the network's central processing infrastructure. The Draft Rules define it as the entity authorized by Banco de México to operate a centralized mechanism through which acquirers and issuers exchange authorization requests and responses, refunds, adjustments, chargebacks and other financial obligations related to card payments, including clearing and, where applicable, settlement (art. 2, § IV).

Its position within the architecture is especially relevant because art. 16 establishes that each Card Payment Network is integrated with a single Clearing House. Issuers and acquirers connect around this clearing house, and it is from there that central transaction processing is coordinated.

The Clearing House, however, does not operate in isolation. When a transaction involves an acquirer connected to a clearing house different from the one the issuer is connected to, Interoperability Conditions come into play. Art. 19 requires the transaction to be processed under the terms of the acquirer's network and the applicable interoperability conditions; any agreement between clearing houses must also be documented in accordance with the provisions issued by Banco de México.

The Brand Owner is the participant that owns a brand suitable for use on cards and that licenses its use to issuers, acquirers and, in certain cases, specialized companies (art. 2, § XXVII). Its role is not limited to commercial licensing: it participates in the network's technical and security infrastructure.

Under arts. 50 and 51, it must provide the corresponding identification numbers and set the standards, conditions, specifications and technical rules that issuers and acquirers using the brand must observe. It must also make the terms of its services and its price lists public to current and prospective participants.

One of the most significant changes is that the Draft Rules make it jointly and severally liable for settlement when an issuer using its brand falls into default or breach vis-à-vis acquirers (art. 52). To that end, it must hold immediately available funds and set transparent criteria regarding guarantees and collateral.

At the same time, arts. 53 and 54 limit how it may use its standards or position within the network: it may not condition brand use on other services, impose certain differentiated fees, penalize minimum volumes, or set technological conditions that hinder competitors' entry.

The Specialized Company is the participant registered with the CNBV to provide certain Specialized Services to other network participants (art. 2, §§ XI, XVI and XIX). Its status as a participant is functional: it only acquires that status with respect to the Specialized Services it actually provides.

This category allows certain technical and operational functions to be provided by specialized third parties without shifting to them the obligations that fall on the participant that hires the service. Art. 27 requires the relationship to be documented contractually, and even allows another network participant to provide Specialized Services, provided it additionally obtains the corresponding registration as a Specialized Company.

The Card Payment Recipient is the individual or entity that, under a contract with an acquirer or aggregator, accepts card payments through a POS terminal (art. 2, § XVII). Legally, it does not form part of the Card Payment Network Participants defined by the Draft Rules, but it is one of the main beneficiaries of the transparency and settlement rules.

Its direct legal relationship is with the acquirer or aggregator. Under the new regime, it must receive greater detail on the Discount Rate, charges, fees, chargebacks, refunds and withholdings; settlement must also take place under the conditions and terms set out in art. 31, while arts. 39 and 40 establish specific contractual transparency and information obligations.

The Cardholder is the holder of a card that may be used within the networks (art. 2, § XXI). It is the party that economically initiates the transaction by using its card to pay the recipient.

Although the Draft Rules do not treat it as a regulated network participant, many of the obligations imposed on the other actors are designed to protect its experience: card security, interoperability, service continuity, fraud prevention, claims handling and information protection.

Finally, the new architecture adds a much more visible layer of supervision. The CNBV and Banco de México are jointly defined as the Authorities (art. 2, § III) and have the power to request information on prices, contracts, costs, methodologies, participation conditions and registrations (arts. 8 to 10).

Supervision is not limited to receiving information. The authorities may review contracts and agreements and order their amendment when they contravene the Law or the new Rules (art. 9), as well as order adjustments to fees, commissions and other consideration (art. 10).

In addition, all participants must register with the CNBV under the function they actually perform (acquirer, aggregator, issuer, specialized company or brand owner) before they begin offering their services (art. 63). This obligation reinforces one of the central features of the new scheme: the function an entity performs within the network is no longer merely a contractual or commercial matter, and becomes an expressly registered and supervised regulatory category.

One of the most significant changes in the Draft Rules is that the principles of open access, non-discrimination and interoperability stop operating merely as general criteria and turn into concrete obligations governing how networks must be designed and operated. The Terms and Conditions for Participation must allow new participants to be admitted on competitive, non-discriminatory and equitable terms, and must expressly govern matters such as interconnection, technical and operational standards, information security, business continuity, onboarding processes, governance, dispute resolution and technology updates (art. 3, §§ I to XII).

Operationally, this means that access to a network can no longer depend solely on commercial, technical or contractual rules set at the discretion of its participants. Entry requirements, certifications, service levels, technology standards, connection processes and update mechanisms must be documented, transparent, and capable of being justified to other participants and to the authorities. The Draft Rules themselves require that prospective participants have access, before contracting, to the applicable Terms and Conditions, technical specifications and required service levels (art. 25).

This obligation is complemented by express prohibitions. Participants may not block, reject or slow down services coming from other Card Payment Networks; prevent other participants from accessing the network; grant exclusivities that produce discriminatory effects; condition their services on specific providers; or impose tied sales, cross-subsidies or minimum-volume penalties (art. 23, §§ I to VIII). As a result, a technical or contractual decision that restricts a competitor's connectivity should no longer be analyzed solely as a commercial decision, but also from the standpoint of access, interoperability and competition within the network.

Interoperability occupies, in this sense, a central place. Art. 18 requires the Network Participant Identification Numbers used by Issuers and Acquirers to comply with international standard ISO/IEC 7812 and, more importantly, requires participants to accept any identifier issued and used under that standard in any of the Card Payment Networks in which they participate.

Operationally, this rule seeks to prevent the technical identification of Issuers or Acquirers from functioning as a barrier to processing transactions between networks. Routing, processing, authorization and reconciliation systems must be able to recognize participants belonging to different networks, without requiring proprietary identifiers or configurations that artificially block their processing. In practice, this means interoperability must be built into the design of systems, routing tables, validations, certifications and connection procedures, rather than being addressed only through exceptions or after-the-fact bilateral development.

The Draft Rules also expressly govern the scenario where a transaction involves two different networks. When the Acquirer has a contractual relationship with a Clearing House different from the one the Issuer is connected to, Card Payment Services must be processed under the Terms and Conditions of the network to which the Acquirer belongs and the applicable Interoperability Conditions (art. 19). Where interoperability agreements exist between the clearing houses involved, they must be observed and documented in accordance with the provisions issued by Banco de México. This has an important consequence for network architecture: a transaction is no longer limited to the Clearing House each participant directly operates with; the regulatory design assumes that a payment can originate on the acquiring side in one network and reach an Issuer connected to another, so clearing houses and participants must have rules, messaging, reconciliation processes and interoperability mechanisms in place to complete the transaction end to end. In this scenario, the Interchange Fee applicable will be the one set by the Issuer of the card that originated the payment (art. 20).

Interoperability is also not limited to transaction routing. Issuers, Acquirers, Aggregators and, where applicable, Specialized Companies must have sufficient technology infrastructure to efficiently process the services and messages assigned to them, and must comply with the information security and business continuity obligations set out in Annexes 3 and 4 (art. 26). Compliance with these provisions will therefore require reviewing not only contracts, but also technology architecture, processing capacity, continuity, cybersecurity, certifications and internal change-implementation processes.

One of the most significant economic changes in the Draft Rules is the introduction of a new regime for determining and controlling Interchange Fees for Card Payments. The Interchange Fee is defined as the total amount the Acquirer pays the Issuer for each Card Payment, whether as a percentage of the transaction amount, a fixed amount, or a combination of both (art. 2, § VIII). It is therefore not a fee charged directly by the network or the Clearing House, but an economic transfer from the acquiring side to the issuing side within each transaction.

The Draft Rules keep the power to set Interchange Fees with Issuers, but that power is no longer unrestricted. Arts. 56 and 57 set out a system under which Issuers may set fees individually; agree on the same fees with other Issuers, potentially consulting other participants and the network's Clearing House; or adopt the fees agreed by the Issuers of the Card Payment Network to which they belong. In any of these cases, the resulting fee must stay within the regulatory limits set out in the Draft Rules themselves.

The change matters: the Issuer keeps the ability to set the interchange price, but the regulator determines the perimeter within which it may do so. The regulation sets both a cap applicable to each individual transaction and a second cap tied to the aggregate behavior of fees charged over twelve consecutive months.

Art. 56 sets two different controls depending on the type of card. For cards issued under contracts other than credit-granting agreements, the final regime sets a maximum Interchange Fee of $10.80 per transaction and an aggregate cap under which the total Interchange Fees charged over twelve consecutive months must represent at most 0.30% of the total amount transacted with such cards over the same period. This group generally covers cards not issued under a credit agreement, including debit, prepaid or other structures that fall under that contractual category. For cards issued under credit-granting agreements, the maximum Interchange Fee is 1.30% of the amount of each transaction, with an aggregate cap of 1.00% of the total amount transacted over twelve consecutive months.

The two caps are cumulative. Meeting the cap applicable to each transaction does not, by itself, guarantee regulatory compliance: the Issuer must simultaneously ensure that the sum of the fees actually charged stays within the permitted aggregate percentage. Importantly, these caps must be distinguished from other fees or consideration related to the product. Art. 56 specifically regulates the Interchange Fee the Acquirer pays the Issuer, and does not, by itself, mean the Issuer is barred from charging the customer other fees associated with contracting or providing the product.

The aggregate cap is calculated over a rolling twelve-month window: the numerator is the sum of all Interchange Fees actually charged over the twelve months, and the denominator is the total amount of Card Payments made over the same period. The result must be, at most, 0.30% for non-credit cards and 1.00% for credit cards.

This introduces a fundamental difference between a transaction-level control and a portfolio-level control. The Issuer cannot simply configure its systems so that no single transaction exceeds $10.80 or 1.30%; it will also need to continuously monitor the relationship between accumulated fees and total volume processed over the twelve-month window. The effect is particularly visible for non-credit cards, because the individual cap is expressed as a fixed amount of $10.80, while the aggregate cap is expressed as a percentage.

Consider a simplified portfolio of 100 transactions. In a scenario with $1,000 tickets (transacted amount of $100,000), charging the maximum of $10.80 per transaction produces $1,080 in fees, equivalent to an effective aggregate fee of 1.08%: even though each individual transaction meets the cap, the portfolio would substantially breach the 0.30% aggregate cap. By contrast, with $10,000 tickets (transacted amount of $1,000,000), the same $10.80 charge per transaction produces $1,080 in fees, but the effective aggregate fee is just 0.108%: in this second case, the same charge satisfies both the individual maximum and the aggregate cap.

This reveals an important economic consequence of the regulatory design: for non-credit cards, the aggregate cap will be particularly relevant in portfolios with low average tickets. The point at which a $10.80 fee equals exactly 0.30% of a transaction is a $3,600 ticket. Below that amount, systematically charging the $10.80 maximum tends to produce a ratio above 0.30%; above it, the individual cap starts to become relatively more restrictive.

The Draft Rules allow Issuers to set Interchange Fees that differ by transaction, but significantly restrict the logic under which that differentiation may be applied (art. 58). First, no differentiated fee may exceed the individual cap in art. 56: $10.80 for non-credit cards, or 1.30% for credit cards. Second, the differentiation must be justified solely on the basis of real, verifiable costs derived from the Card Payment Services actually provided by the Issuer, with the Draft Rules noting, on a non-exhaustive basis, operational and technological risks related to the service that directly affect the Cardholder, and differences arising from the type of technology used to access or authenticate the Card Payment.

This significantly limits the ability to differentiate Interchange Fees for purely commercial reasons: the existence of a different rate must be traceable to an identifiable, verifiable difference in the costs associated with the transaction. Third, allowing differentiated fees does not eliminate the aggregate cap: the Issuer may have multiple fee tiers within its portfolio, but the sum of all of them will remain subject to the 0.30% or 1.00% cap, as applicable, over the twelve-month window set out in art. 56. The Issuer will therefore need to manage two levels of compliance simultaneously: the permitted price for each transaction and the aggregate economic behavior of the portfolio.

In addition, the final paragraph of art. 58 reserves for the CNBV and Banco de México the ability to jointly set certain Interchange Fees to support social sectors or economic activities, or to foster the sound and balanced development of the payments ecosystem.

The new regime does not stop at the economic calculation of the fee either. Under arts. 61 and 62, Interchange Fees must be registered with Banco de México before they take effect, and the registration must be supported by the methodology used to determine them. In particular, the Issuer must submit, among other elements, the Interchange Fee it intends to apply, any differentiated fees, its determination methodology, the Clearing House it is connected to, and the effective date. Banco de México may also request information on income and fixed and variable costs used to determine the fees.

The consequence is significant: interchange pricing becomes a documented regulatory process. Setting the fee will need to connect financial data, economic methodology, verifiable costs, technology configuration and regulatory registration.

The Draft Rules also provide a specific mechanism for when an Issuer exceeds the aggregate caps. Under art. 59, the CNBV may issue recommendations as soon as the excess is identified. If it persists for three consecutive months, the Issuer must submit a work plan to return to compliance within a maximum of three months, including procedures, actions, indicators and monitoring scenarios. If the plan is not submitted, is not carried out, or proves ineffective, the CNBV may require the Interchange Fees to be modified, without prejudice to any applicable sanctions.

This confirms that the aggregate cap should not be understood as a metric checked once a year. The Issuer must maintain continuous monitoring of its regulatory position, because the regulation tracks its behavior monthly over a rolling twelve-month window.

The reduction in Interchange Fees will not be immediate. The Draft Rules provide for a phased implementation, with transitory caps that will be reduced progressively until reaching the final regime set out in art. 56. The per-transaction caps and the aggregate caps follow different timelines.

Under Transitory Article Five, once the first year of the Rules' effectiveness has elapsed and the deadline for the initial registration of Interchange Fees has been met, Issuers must observe a progressive reduction of the applicable per-transaction maximums: in a first phase, up to $12.80 per transaction for non-credit cards and up to 1.65% of the transaction amount for credit cards; during the following year, the caps will drop to $11.80 and 1.40%, respectively; once that second phase concludes, the final caps of art. 56 will apply: $10.80 per transaction for non-credit cards and 1.30% for credit cards. (Transitory Article Five states the figure $11.80 numerically in the second phase, although the parenthetical text reads twelve pesos 80/100 M.N.; this inconsistency is worth flagging if the Draft Rules are not corrected in their final version.)

Transitory Article Six sets a separate transition for the aggregate caps — that is, for the ratio between total Interchange Fees charged and the total amount transacted over the preceding twelve months: at 24 months of effectiveness, the aggregate cap will be 0.40% for non-credit cards and 1.20% for credit cards; at 36 months, the caps will drop to 0.35% and 1.10%, respectively; after that, the final caps of art. 56 will apply, equivalent to 0.30% and 1.00%.

In practice, this design creates two parallel implementation curves: one for the maximum allowed on each transaction, and another for the portfolio's aggregate behavior over a rolling twelve-month window. Issuers must therefore plan the transition of their pricing and monitoring models well in advance, since compliance will not depend solely on adjusting a rate on a given date, but on keeping the portfolio's accumulated behavior within progressively stricter caps.

The Draft Rules do not set out a standalone schedule of fines for each obligation they introduce. Compliance is folded into the sanctions regime primarily set out in the Law for the Transparency and Regulation of Financial Services (LTOSF) and, depending on the nature of the participant and the conduct involved, may coexist with other regulatory and antitrust regimes.

Regulatory exposure, however, does not begin with the imposition of a fine. The Draft Rules grant Banco de México and the CNBV broad powers to request information and documentation regarding network operations, including Interchange Fees, Commissions and other consideration; the methodologies used to determine them; direct and indirect costs; product and service profitability; Terms and Conditions for Participation; and participants' contracts and records (arts. 8 and 9).

Particularly significant is that the authorities are not limited to reviewing this information. When they identify that a contract, agreement, Interchange Fee, Commission or other condition contravenes the LTOSF or the new Rules, they may — after a hearing — order it to be modified (arts. 9, 10 and 13). The Draft Rules set out a procedure under which the participant may submit statements and offer evidence, but if these do not resolve the observations, the authority may order the corresponding adjustments and set a deadline for their implementation.

On Interchange Fees, there is also a specific corrective mechanism. If an Issuer exceeds the aggregate caps, the CNBV may issue recommendations and, once the excess persists for three consecutive months, the Issuer must submit a work plan to return to compliance. If the plan is not submitted, is not carried out, or proves ineffective, the CNBV may order the Interchange Fees to be modified, without prejudice to any applicable sanctions (art. 59).

The LTOSF complements this scheme. Its article 49 Bis 1 empowers the CNBV to conduct inspection visits, request information and documentation, and summon shareholders, officers, representatives and employees of Network Participants. Article 49 Bis 2, for its part, sets fines of 5,000 to 20,000 UMA for Entities and Network Participants that breach the Law or the general provisions jointly issued by the CNBV and Banco de México on Payment Instrument Networks; in case of repeat offenses, the sanction may double. This means the main risk of the new regime is not purely punitive: non-compliance can lead to regulatory information requests, forced amendments to contracts or fee structures, corrective plans, operational and technology adjustments, and, ultimately, monetary sanctions.

The Draft Rules also raise a particularly sensitive point on antitrust matters. Article 57 allows Issuers to set their Interchange Fees individually, agree on the same fees with other Issuers, or adopt the fees agreed by the network's Issuers.

This sector-specific allowance must be handled carefully. It should not be read as a general authorization to exchange commercially sensitive information between competitors beyond what is necessary to set Interchange Fees under the mechanism set out in the Rules: information on margins, pricing strategies, customers, discounts, volume projections, profitability or commercial terms unrelated to that process should continue to be analyzed under general antitrust rules.

This point is especially relevant given that one of the precedents behind the Draft Rules is COFECE's IEBC-005-2018 investigation, which identified risks arising from the mechanisms through which competing participants took part in setting the rules of the Domestic Network and shared information within their governance structures.

Although the text is still in public consultation, the depth of the changes justifies starting a diagnostic before its eventual final publication. The priority should not be simply adjusting a rate, but determining how the new regime affects each participant's entire operating model.