FinTech Myths in MEXICO 🇲🇽
Mexican regulations are especially confusing when it comes to processing payments so I will focus on e-commerce companies.
During the past 25 years, but especially in the last 10, Mexico’s adherence to multiple bilateral and international treaties has the meant the inclusion of several new businesses and business sectors in the Mexican economy. Perhaps no sector has had a faster and more disruptive entrance in the economy than e-commerce, bringing with it new challenges for regulators who must find a balance between protecting the consumer and allowing these new economic forces to grow and expand, creating greater employment and other, related byproducts.
But first, many of these new companies are faced with an important decision, where should I locate my servers? It is important to note that the e-commerce sector has far outpaced the server industry’s expansion into Mexico, thus creating the need for this question to be answered altogether. The latter notwithstanding, this question must be answered since server location will determine strategic points in negotiating agreements, providing services, etc.
The current server industry landscape in Mexico is mainly comprised of local players, with international companies such as Google, Microsoft and Amazon Web Services (AWS) still assessing their initial immersion in the country. This has created a pervasive status quo, on one hand, local players have created confusion regarding the regulation (reaping the benefits), this confusion has been furthered by effective lobbying efforts with the banking and financial sectors.
The status quo notwithstanding, in order to properly locate a company’s server, it is important to understand what type of information will be gathered from the customer, what processes will be carried out on the server, and finally, for what amount of time will the customer’s information be stored on the server? These questions all relate to companies’ handling of certain types of information as mandated by the Ley Federal de Proteccion de Datos Personales en Posesión de Particulares (LFPDPPP).
First and foremost, it is important to distinguish between personal (general information such as name and birth date) and sensitive (sexual preference, ethnicity) information since each type will mean a different set of obligations for the person or company managing the information.
This first regulatory hurdle is easily overcome, as it relates to server location since the LFPDPPP contains no restrictions on server placement, moreover, the LFDPPP provides for cross-border information traffic.
As for the amount of time any given company must store the information gathered by its users, the legal framework states that an appropriate amount of time for the company to fulfill its described use.
So, plainly speaking, data management regulations in Mexico do not restrict e-commerce or other software-based companies from contracting foreign-based servers, if the rates or other competitive advantage compels them, to do so.
However, this applies to most e-commerce companies in general terms, which leaves the financial sector, who work with more stringent regulations. Specifically regarding the Circular Única de Bancos, which regulates the banking sector’s contracting with third parties, states that the banks may contract a third party to provide for I.T. services and databases. The latter confirms the possibility of a bank contracting a foreign service provider to manage its processes, from payment, to credit or others, and even store the ban’s information.
It should be noted that the CUB states that the bank must file notice with CNBV, which may further revise the agreement, or even ask the bank to contract a different third party altogether. This differs from other third-party contracting with banks where the bank is obligated to obtain an “authorization” from CNBV before contracting. The practical difference is no coincidence, as drafting legislators provided for a mechanism for banking and financial sector entities to hire the best possible service provider without the need for CNBV to intervene directly.
Other legislation applicable to the financial sector follows the same line of thought. Sadly, the Supreme Court or even the lower circuit courts have not yet issued a resolution that clarifies this, none of the major international companies have sought an Amparo suit in order to further define, once and for all, the government’s stance on the issue.
Thus, currently local server services providers have effectively monopolized the financial sector, and perhaps more pervasively, have created a closed looped of banking related companies who must now adhere to the banks’ demands, regardless of the fact that local server service providers offer a costlier, slower service. It should be evident that the status quo is an obvious attempt against anti-trust and other free-market regulations, in theory, at least, it could open the door for a company to enter the Mexican market by entering an Amparo suit, although this appears to be a distant possibility.
In the long run, this discussion will (hopefully) be proven to be obsolete, since major server services providers are poised to make their first forays in-country during this year’s final quarter. However, if due to lacking infrastructure or other, endemic, issues; international server services continue to prove either cheaper or more reliable, then this issue will once again gain relevance.
Initial drafts regarding secondary legislation for Financial Technology companies do not seem to consider answering this question, and rather seem mainly directed to further regulating the day-to-day activities of regulated entities. Therefore, due to the apparent lack of legislative interest in the matter, only banks and other financial companies willing to try their luck against CNBV, preferring lower costs and better service over regulatory burdens will change the tide in favor of an open market, in tune with the current state of affairs in the continent and the world as a whole.
