Mexico fintech regulation a ‘death sentence’ for firms using FaaS model

A new regulation quietly introduced by Mexico’s financial sector watchdog CNBV is “a death sentence” for companies operating with the Fintech-as-a-Service (FaaS) business model, industry experts said.

“It appears that [the CNBV notice] is a death sentence for the FaaS model,” according to an analysis by Carlos David Valderrama Narvaéz and Diego Montes Serralde of fintech consultancy Legal Paradox.

According to the rule, already published December 4 and available here, in Spanish, only regulated financial institutions, such as commercial banks and fintechs that are either authorized or in the authorization process may represent themselves as financial services provider to the public.

The rule essentially denies legal status to third-party operators that use fintech platforms or application programming interfaces (APIs) to provide financial services independently. 

The authors of the analysis wrote that while a path forward on Open Banking remains in place, “we are clearly facing a countdown [with FaaS], so it is very important that the largest FaaS service providers in the market ‘pivot’ their business model and that the entrepreneurs who are with them seek immediate legal advice.” 

Juan Luis Hernández, partner at Guadalajara-based law firm Novus Concilium told local news outlet El CEO on Monday that “the CNBV's position is outlined very well, and it is a reasonable position,” adding, “what they are telling us is that we do not care if you have your brand, we are only authorizing your company and you are the only one authorized to provide these services.”

What’s FaaS?

The FaaS model is the latest iteration of the Software-as-a-Service (SaaS) concept and involves business licensing of software for firms to create their own products. The idea has been around since the 1960s. It has more recently been applied to the Open Banking concept via Banking-as-a-Service (BaaS), with banks providing access to their APIs, as is the case with BBVA’s API_Market and in the US with the BBVA Open Platform.

The Legal Paradox experts said that under FaaS, many fintechs often not only offer their APIs but also their operating licenses to financial services actors as software, creating a legal pathway for companies to integrate the technology into their systems.

“Taking advantage of a Fintech-as-a-Service platform allows financial companies to optimize their process from beginning to end, thus guaranteeing the healthy execution of a commercial service, provided over the internet, on request within a specified period,” Valderrama and Montes wrote.

The dilemma emerges when authorization is required, and more pointedly when companies attempt to use the FaaS model to avoid potentially lengthy and costly authorization processes.

“The real problem is not for the previous players, but for the entrepreneurs who, taking into account the complexity of the fintech process, decided to take the ‘fast’ route, using the regulatory infrastructure of a third party in the authorization process to survive,” they wrote.

“These entrepreneurs are the ones who are risking everything, including their own liberty, since it can be argued that they are committing a financial crime.”

Mexico has been a trailblazer in fintech regulation, producing Latin America’s first all-encompassing yet adaptable regulatory framework in March 2018. 

A major aspect of the framework involves requiring an added layer of authorization for certain fintech classes, including crowdfunding, financial leasing and others. 

Since September 2019, when companies were first allowed to apply for authorization, there have been 85 requests, with 74 of the firms already in operation prior to the regulation’s starting date. The only new entity to receive authorization is universal digital payments provider NVIO, whose operations are set to start early 2021. 

Impact on FaaS

“This is a ‘wake up call’ for many platforms, especially some wallets that decided to ‘accelerate’ their start of operations in Mexico without measuring the risks that this entailed, not only for them, but also for the entire Mexican fintech ecosystem,” the analysis said. “They will definitely not be able to operate without CNBV authorization.”

The authors added, “undoubtedly, we will be seeing the beginning of an investigation process [by the regulator] that will put these entrepreneurs and their business models in trouble, but especially the legal advisors who recommended the ‘accelerated’ strategy for their start of operations.”

They also wrote that “to date, there are companies whose sole business model and purpose is to lend their infrastructure under the FaaS model to multiple platforms and ventures in Mexico,” but the CNBV notification is a clear sign this will not be allowed. 

To avoid legal troubles, the Legal Paradox analysis said business owners operating under a FaaS model have four options.

They could close their operations immediately, suspend them and start the authorization process, sell or lease the firm’s technology or transactional volume to entities that already have or are on track to authorization, or change their business model to become leads generators or commission agents for which authorization is not required.