The corp 92 final bundle equips the compliance officer of a fintech, SOFOM, IFPE, exchange house or money transmitter in Mexico City, Guadalajara, Monterrey and Merida with an AES-256 encrypted USB-C drive with FIPS 140-3 level 3 certification, NOM-151 advanced e-signature kit with cryptographic token, tamper-evident packaging with security seal, custom QR code linking to SAT manuals and CNBV circulars, and corporate binder for filing constancias de hechos and transaction reports. The CFDI 4.0 invoice includes the Carta Porte 3.0 complement when delivery is interstate.
Mexico is the second-largest fintech market in Latin America per the Finnovista Fintech Radar Mexico 2024 report, with more than 650 active companies distributed across digital payments, lending, wealth management, crowdfunding, insurtech, cryptoassets, neobanks and regtech. The Comision Nacional Bancaria y de Valores (CNBV) supervises the Instituciones de Fondos de Pago Electronico (IFPE), the Sociedades Financieras de Objeto Multiple (SOFOM) in regulated and unregulated modalities, and money transmitters that require authorisation. Banco de Mexico (Banxico) regulates the SPEI electronic payment system, CoDi and virtual-asset operations in coordination with the Unidad de Inteligencia Financiera (UIF).
The Ley para Regular las Instituciones de Tecnologia Financiera (Fintech Law) entered into force in 2018 and established two main regulatory figures: Instituciones de Financiamiento Colectivo (crowdfunding) and Instituciones de Fondos de Pago Electronico (IFPE, formerly known as wallets). IFPE require a minimum capital of 50 million UDIs (approximately MXN 320 million at the 2026 exchange rate) and must keep margin accounts at Banco de Mexico, file monthly operation reports and comply with applicable Disposiciones de Caracter General. Regulated SOFOM require CNBV authorisation and minimum capital based on the operation level.
The Ley Federal para Prevenir e Identificar Operaciones con Recursos de Procedencia Illicita (AML/CFT Federal Law) requires all financial entities, including fintech, to identify and report suspicious transactions to the UIF, keep customer-identification records (KYC), file monthly reports of relevant operations, and appoint a compliance officer responsible for the AML programme. Fines for non-compliance range from 200 to 65,000 minimum wages and may be accompanied by activity suspension or authorisation revocation.
NOM-151-SCFI-2016 sets the requirements that providers of certification services must observe for data-message preservation and issuance of con-stancias de hechos. Advanced e-signature issued by a Prestador de Servicios de Certificados (PSC) authorised by the Secretariat of Economy carries the same legal validity as a handwritten signature. Compliance officers use NOM-151 signatures to sign tax returns, UIF reports and contracts with corporate clients in the financial sector.
The kit ships in a sealed box with numbered security tape and is transported under chain-of-custody protocol with sign-off from the receiving compliance officer. The box includes a step-by-step activation guide and a QR code linking to the initial-setup video.
USB-C solid-state drive with AES-256 XTS hardware encryption, FIPS 140-3 level 3 certification (the highest for cryptographic storage), password authentication 7 to 64 characters, key self-destruction after 10 failed attempts, DRBG cryptographic random-number generator, USB-C 3.2 Gen 2 connection with read speed up to 1,050 MB/s. Capacities 256 GB, 512 GB or 1 TB. Compatible with Windows, macOS, Linux, iOS and Android. Anodised aluminium housing with physical-tamper detection and anti-manipulation protection.
USB cryptographic token (security key) compatible with FIDO2/WebAuthn, PIV (Personal Identity Verification) and OpenSC for storage of NOM-151 digital certificates issued by an authorised PSC. FIPS 140-2 level 3 certification, RSA 2048/4096 and ECC P-256/P-384 key generator, NFC reading for mobile authentication. Compatible with Firefox, Chrome, Edge, Safari and banking apps. IP68 water-resistant housing. 6 to 8-digit PIN with self-destruction after 5 failed attempts.
Cardboard box with numbered holographic seal, security band with corporate logo and unique opening code, thermochromic security tape that changes colour when tampered with, security bag with Void-If-Opened closure. Serialised alphanumeric 16-character QR code for online verification of seal status. Recyclable materials with FSC certification. The compliance officer validates seal status online before accepting delivery and logs the validation in the document management system.
Lever-arch binder letter-size with 3-inch ring mechanism, capacity for 600 sheets, navy-blue linen-wrapped cover with gold stamping of corporate logo, customisable spine, colour plastic dividers with section labels (KYC, UIF, SAT, CNBV, Banxico). Plastic pockets for CD/USB discs. Key-locked closure for confidential filing. Space to keep the encrypted USB and cryptographic token between uses. Compliant with the AML/CFT five-year retention requirements.
The corp 92 final bundle is invoiced under CFDI USO key G03 (general expenses) with deductibility under Article 27 LISR as regulatory-compliance operating expense. For fintech under SOFOM or IFPE tax regime, the invoice is issued with activity key 522110 (multiple-banking services) or 522390 (other non-bank financial services). The CFDI 4.0 invoice includes the corporate RFC and the recipient's fiscal-address postal code.
The 16% IVA breaks out line by line on the CFDI 4.0. For deliveries from the CDMX distribution centre to offices in Guadalajara, Merida or Monterrey, the Carta Porte 3.0 complement is attached with shipment data, transport operator, SAT transport key and SCT permit type. Delivery of the encrypted USB and cryptographic token requires specialised courier with insurance and chain of custody, since the kit value exceeds MXN 5,000 and triggers insurance requirements.
For fintech corporates issuing CFDI de ingreso to their users for fees or interest, the corp 92 final bundle is booked as corporate administrative expense and deducted as operating expense. The accounting entry is filed with the monthly close and reported as administrative expense in the audited financial statements. Annual external audit reviews the consistency between the CFDI 4.0 invoice and the accounting entry, and may request supporting documentation (FIPS certifications, packing list with recipient).
For fintech with operations in Mexico and the United States (Rappi, Kavak, Bitso, Mercado Libre Mexico), the kit is delivered to the Mexican office and invoicing runs in MXN or USD per the corporate's intercompany policy. Conversion uses the FIX exchange rate published by Banco de Mexico on the day before the invoice. For corporates reporting to the US Securities and Exchange Commission (SEC), the kit expense is reported as compliance expense in the annual 10-K report.
The AML/CFT Federal Law requires financial entities to implement a money-laundering-prevention programme with five minimum pillars: documented policies and procedures, designated compliance officer, ongoing staff training, transaction-monitoring systems, and annual independent-audit review. The corp 92 final bundle supports all five pillars with specific pieces: the encrypted USB for storing policies and procedures, the cryptographic token for signing UIF declarations, the corporate binder for archiving reports and constancias, and the tamper-evident packaging for proving chain of custody in branch shipments.
The compliance officer is the centrepiece of the AML programme. CNBV and UIF may summon the compliance officer for interviews, document reviews and authority appearances. The corp 92 final bundle includes a printed manual of the compliance officer's responsibility regime, with chapters on identifying unusual transactions, reporting relevant and concerning transactions, managing national and international blacklist screening (SAT's Lista 69-B, OFAC SDN, UN), and cooperating with authorities in investigations.
Transaction monitoring runs through specialised systems (NICE Actimize, SAS AML, FICO TONBELLER) that analyse transactional patterns, geolocation, customer profile and historical behaviour to identify suspicious patterns. The kit does not include the software platform, but the encrypted USB stores the fintech-parameterised monitoring policies, system user manuals and encrypted parameter backups. Record retention runs for five years per the AML/CFT Federal Law.
Staff training is mandatory for all fintech employees, with annual courses on identifying unusual transactions, customer knowledge, internal and external reporting, and personal-data protection under LFPDPPP. The corp 92 final bundle includes DC-3 constancias signed by an STPS-registered trainer to back the training against potential CNBV or UIF inspections. The DC-3 constancia is filed with the employee's record and kept for five years.
The AES-256 encrypted USB with FIPS 140-3 level 3 certification meets the physical and logical security requirements that LFPDPPP demands for processing sensitive personal data. The hardware encryption operates transparently for the user: the operating system detects the drive as mass storage but requires prior authentication to access the data. Key self-destruction after 10 failed attempts protects against brute-force attacks.
The FIDO2/WebAuthn cryptographic token enables passwordless two-factor authentication (2FA) for corporate internal web applications (email, VPN, compliance systems). The combination of encrypted USB + cryptographic token + strong password meets the Zero Trust model that many Mexican fintech have adopted to reduce the attack surface. Integration with Azure Active Directory, Okta, Google Workspace and OneLogin runs through open standards and requires no additional corporate licensing.
Tamper-evident packaging with numbered holographic seal protects the kit's chain of custody from distribution centre to compliance officer's office. Online verification of seal status via serialised QR code confirms the package was not opened during transport. In case of a violated seal, the incident is documented and the kit is replaced at no cost to the corporate. The courier complies with NOM-251 for electronic-device transport and carries cargo insurance.
The key-locked corporate binder meets the confidential-document-retention requirements. The key lock prevents unauthorised access to constancias de hechos, UIF reports and NOM-151-signed tax returns. Filing happens in a biometric or card-access-controlled office, in a lockable cabinet under compliance-officer supervision. Annual external audit verifies filing compliance and retention deadlines.
Pricing in MXN before 16% IVA. The corp 92 final bundle starts at MXN 8,950 per compliance officer from MOQ 5 pieces. In series of 20 to 50 kits for a fintech with several officers across regions, the unit cost drops to MXN 7,420. In annual contracts for fintech or SOFOM with established compliance programmes, the unit cost drops to MXN 6,180 with safety stock, automatic replenishment and scheduled per-office delivery. The CFDI 4.0 invoice is stamped with deductibility as regulatory-compliance operating expense.
Production lead times run 8 to 12 business days for kits with FIPS 140-3 level 3 encrypted USB and FIDO2 cryptographic token. USB encryption activation runs in the distribution centre under chain-of-custody protocol and ships with an initial random password communicated separately to the compliance officer via secure channel. The cryptographic-token delivery includes the officer's NOM-151 digital certificate, generated by an authorised PSC and installed on the token under the corporate IT area's supervision.
For fintech corporates with operations in Mexico and Latin America (Brazil, Argentina, Chile, Colombia), we coordinate deliveries with a single point of contact from CDMX. The invoice is issued in MXN with per-office breakdown and compliance with local temporary-import regulations when the kit crosses the border. Delivery timeline extends to 10 business days for non-Mexico destinations, with specialised courier and international cargo insurance.
Yes. The USB-C encrypted drive in the corp 92 final bundle carries FIPS 140-3 level 3 certification (the highest certification for cryptographic modules) issued by the US NIST and recognised by CNBV and UIF for sensitive-data storage. Certification covers the AES-256 XTS algorithm, the key generator, physical-intrusion detection and self-destruction after failed attempts. The NIST certificate is filed with the corporate documentation and retained for five years.
Yes. The FIDO2 cryptographic token in the corp 92 final bundle is compatible with SAT advanced e-signature (e.firma) and with NOM-151 signature issued by an authorised PSC. The digital certificate is generated at the PSC (Autoridad Certificadora Raiz at the Secretariat of Economy or authorised commercial PSC), downloaded onto the token under secure protocol and activated with the compliance officer's password. Certificate validity runs four years and renews remotely with prior appointment at SAT.
The chain of custody of the corp 92 final bundle is documented with four instruments: courier waybill with compliance officer signature on receipt, numbered holographic seal with online verification, serialised QR code to validate seal status, and signed receipt with official ID of the receiving officer. The courier complies with NOM-251 for electronic-device transport and carries cargo insurance for the declared kit value.
Yes. The corp 92 final bundle meets the physical and logical security requirements for processing personal data under LFPDPPP. The AES-256 encrypted USB protects sensitive personal data stored on the device. The cryptographic token prevents unauthorised access to systems containing personal data. Tamper-evident packaging protects the physical device's chain of custody. The key-locked corporate binder meets confidential-retention requirements.
Yes. We coordinate deliveries to compliance officers in CDMX, Guadalajara, Monterrey, Merida, Tijuana, Leon and Puebla with a single point of contact from the CDMX distribution centre. The courier meets the security requirements for interstate electronic-device shipment, with cargo insurance and signed chain of custody at each destination. The CFDI 4.0 invoice is issued consolidated with per-recipient-office breakdown and the Carta Porte 3.0 complement when ground or air freight applies.
Kit replacement is requested through the compliance area and documented with an incident report to the Asset Protection Department and UIF when applicable. The compliance area issues a replacement order and the kit is delivered charged to the area's operating budget. The replacement includes a new encrypted USB with certificates re-issued by the PSC, a new cryptographic token configured with new certificates, and tamper-evident packaging with numbered seal. Replacement lead time is 8 to 12 business days.