Banxico Opens Consultation to Strengthen Financial Cybersecurity

The Bank of Mexico (Banxico) has initiated a public consultation process, effective up to Feb. 11, 2026, to update information security provisions and data supply rules for commercial banks. The initiative responds to the necessity of standardizing digital risk management and ensuring the integrity of critical payment systems. 

"The objective is to establish a standardized regulatory framework that incorporates elements to safeguard information security and computer security, aligning with efforts to protect the integrity of information in an environment of increasing digital threats and organizational modernization," says Banxico.

The accelerated digitalization of the Mexican financial system has increased the attack surface for malicious actors. Banxico, in its role as the monetary authority and regulator of payment systems, seeks to mitigate systemic vulnerabilities by updating the information technology manual.

The consultation aims to address two critical factors: the sophistication of cyberattacks against financial infrastructures and the obsolescence of certain communication protocols when facing new cloud architectures and third-party services. By proposing these reforms, the central bank intends for commercial banks to maintain a proactive cyber-resilience posture rather than merely reacting to incidents. This approach ensures the operational continuity of the information collection system known as SAIF.

Technical Requirements and Compliance Standards

The project details specific obligations that financial institutions must integrate into their organizational and technical structures:

• Governance and Accountability: Financial entities must appoint a compliance officer as a qualified technical representative. This individual serves as the central node for the supply of information to Banxico. Furthermore, institutions may designate operators, representatives, and technological administrators.

• Third-Party and Infrastructure Management: The regulatory framework extends the responsibility of banks to the infrastructure of any third party. The policy requires the implementation of detection and management controls for cybersecurity incidents that could affect operations within the SAIF.

• Security Protocols and Detection: The provisions emphasize the mandatory use of secure communication protocols throughout the computing infrastructure. Additionally, banks must deploy technological tools for the detection of viruses and malicious code, as well as for the identification and management of vulnerabilities.

• Continuity and Alternativity: Corporations must maintain robust operational continuity plans and procedures to ensure they can meet information supply obligations at all times. However, the regulation provides flexibility by allowing for alternative controls, provided the institutions obtain prior authorization from Banco de Mexico.

Following the conclusion of the consultation period on Feb. 11, 2026, Banxico will analyze the observations to finalize the secondary regulation. These measures are expected to influence the information technology departments of commercial banks, necessitating adjustments to security policies and reporting procedures.