Data center for banks in Mexico: the 11 regulatory requirements CNBV will ask you for (CNBV, Banxico)

What a Mexican bank has to demonstrate before putting a data center into production

A data center that operates for a regulated financial institution in Mexico is not designed like an enterprise one. Mexican banking is supervised by the National Banking and Securities Commission (CNBV, Mexico’s banking and securities regulator) and, for payment systems, also by the Bank of Mexico (Banxico, Mexico’s central bank). These two bodies issue technical rules that apply directly to the data center provider serving banks, licensed fintechs, or Sofomes/Sofipos (non-bank financial companies and savings institutions). The eleven operating categories typically subject to supervision combine requirements for operational continuity, cybersecurity, personal data protection, and information residency.

Base regulatory framework

The rules that apply to credit institutions (banks) are set out in the General Provisions Applicable to Credit Institutions, issued jointly by CNBV and Banxico. For fintechs and financial technology institutions (ITFs), the General Provisions applicable to Financial Technology Institutions (CUITF) issued by the CNBV. For Sofomes/Sofipos, other circulars. What they share is a set of technical principles about how systems that process financial information must operate.

The new development is that the Superintendency of Banks of Mexico, created under the financial system reform, has operational supervision powers that include on-site verification of data centers of critical providers. It is no longer enough to declare compliance on paper; supervision visits verify technical implementation.

The 11 typical requirements CNBV will ask you for

1. Information residency in Mexico. Data from Mexican bank customers must be processed and stored in national territory, with specific exceptions for regulated international transfers. For a data center, this means that the primary site and the backup site must be physically in Mexico. Public cloud services with regions outside the country do not satisfy this requirement on their own.

2. Documented and tested Business Continuity Plan (BCP). The bank must have a BCP that includes the data center as a critical element, with defined Recovery Time Objective (RTO) and Recovery Point Objective (RPO) targets demonstrated through annual tests. For a data center, this means documented redundant architecture, documented failover drills, and evidence that the RTO is met under simulated disaster scenarios.

3. Independent third-party certifications. For data centers serving Mexican banks, the certifications that are required or strongly valued are: Uptime Institute Tier III or IV, TIA-942 Rated-3 or Rated-4, ISO 27001, ISO 22301 (business continuity), and SOC 2 Type II. Certifications without an independent third-party audit do not satisfy the requirement.

4. Annual external IT security audit. The data center must have an annual penetration test (pentest), performed by an independent third party, covering physical and logical infrastructure. The report must be delivered to the CNBV as part of the bank’s annual corporate governance report.

5. Logical segregation of environments. The bank’s production, pre-production, development, and test environments must be logically segregated. For a data center, this implies network segmentation, dedicated VLANs, firewall rules between environments, and monitoring of attempts to cross between segments.

6. Biometric or multi-factor physical access control. Physical access to the data center must be protected by at least two factors: card plus biometrics, or equivalent. Auditable access logs with a minimum retention of 5 years. Surveillance cameras with continuous recording and documented retention.

7. Fire suppression systems with clean agents. Data centers that process financial transactions must have fire suppression systems that do not damage electronic equipment in operation: FM-200, Novec 1230, or pre-action water mist systems. Conventional sprinkler systems are not acceptable in a production server room.

8. 24/7 monitoring with incident response capability. The bank must demonstrate capacity for continuous monitoring of its critical infrastructure, with documented incident response procedures. For a data center, this implies a Network Operations Center (NOC) or Security Operations Center (SOC) operating 24/7 with escalation to on-call engineers.

9. Encryption of data at rest and in transit. Sensitive customer data must be encrypted at rest (AES-256 or equivalent) and in transit (TLS 1.2 minimum, ideally TLS 1.3). Cryptographic keys must be managed with an HSM (Hardware Security Module) or equivalent service. For a data center, this applies to storage, databases, backups, and inter-site communications.

10. Incident notification within defined timeframes. The Fintech Law and CNBV Provisions specify notification deadlines: serious security incidents must be reported within 72 hours; incidents that affect personal data within shorter timeframes per the Federal Law on Protection of Personal Data. For a data center, this implies the ability to detect, classify, and report within the defined time.

11. Service provider audits (including the data center). The bank must have a formal process for auditing critical providers, including the data center. Audits are at least annual, with risk assessment, controls review, and verification of contractual compliance. For a data center, this means accepting audits from the banking client, responding to findings, and keeping compliance documentation up to date.

Specific requirements for SPEI and CoDi

If the data center processes transactions of the Interbank Electronic Payment System (SPEI) or of Digital Collection (CoDi), both operated by Banxico, the requirements are additional and stricter:

• Minimum 99.95% monthly availability for systems directly connected to SPEI/CoDi.
• Critical incident response times under 15 minutes for failures that affect settlement.
• Operational contingency plan approved by Banxico before going into production.
• Dual contingency in SPEI communications: two independent telecom carriers, two physically separated routes.
• Specific Banxico audits over systems participating in settlement, with periodicity determined by the amount operated.

For a mid-sized bank that operates above 100,000 daily SPEI transactions, the data center processing them must meet these requirements in continuous operation. The investment in redundancy and monitoring is justified by the cost of an unscheduled outage.

The case of regulated outsourcing

Mexican banks may choose to operate their own data center or hire a service provider. When they opt for outsourcing, the CNBV considers the bank ultimately responsible for regulatory compliance, which means that the data center provider contract must:

• Include audit clauses and right of inspection by the bank and by the CNBV.
• Establish measurable and reportable SLAs, with penalties for non-compliance.
• Guarantee that the provider maintains the certifications for the entire duration of the contract.
• Document the subcontracting chain: if the provider subcontracts critical services, the bank must have visibility and approval.

In practice, this means that a data center serving a Mexican bank must be prepared for frequent audits (from the bank, the regulator, and external auditors hired by the bank) and must keep operational documentation updated on an ongoing basis.

Fintechs as clients

The data center serving authorized fintechs under the Fintech Law faces a subset of these requirements. The CNBV, through the CUITF, requires for ITFs:

• Mandatory MFA on administrative access.
• Encryption of sensitive data at rest and in transit.
• Segregation of environments (production separated from development).
• 24/7 monitoring.
• Incident response plan with mandatory notification.

For the data center, this translates into technical capabilities that a mature enterprise site typically already has, but with formal auditable documentation.

The difference between having control and demonstrating it

The most common pattern in supervision findings at data centers of financial institutions is not the absence of technical controls. It is the absence of documentation demonstrating that those controls actually operate. A data center can have N+1 redundancy in UPS, but without records of quarterly failover tests, the CNBV treats it as undemonstrated redundancy.

The operational discipline that separates a data center that passes supervision from one that receives observations is:

• Up-to-date maintenance logs.
• Documented failover test results.
• Monthly capacity and utilization reports.
• Evidence of annual DR (disaster recovery) exercises.
• Staff training records.
• Current contracts and insurance policies.
• External audit reports delivered on time.

What your next RFP for a banking client should ask

If the data center will serve a regulated bank or fintech, the questions that must appear from the initial RFP:

• Does the site have Uptime Institute Tier III or Tier IV certification? With what level of documentation?
• Does the data center operator have a formal provider audit process that can be documented to the bank?
• What is the monthly availability SLA? What is the penalty for non-compliance?
• Does the data center have experience with regulated Mexican banks? Can it provide verifiable references?
• Does the contract allow on-site audits by the bank and by the CNBV at any time, with reasonable notice?
• Does the data center have its own 24/7 SOC/NOC or does it depend on outsourced services? How is the chain of responsibility documented?
• Are the certifications (ISO 27001, SOC 2) current and up to date? When was the last external audit?

The answers to these questions let the bank assess whether the data center has the operational maturity to support its regulatory load. And they let the data center assess whether it is worth investing in the certifications and operational discipline that this client demands.

Sources

1. Diario Oficial de la Federación (2018). Law to Regulate Financial Technology Institutions (Fintech Law). https://www.diputados.gob.mx/LeyesBiblio/pdf/LRITF.pdf
2. Diario Oficial de la Federación (2014, current reforms). Federal Law on Protection of Personal Data Held by Private Parties. https://www.diputados.gob.mx/LeyesBiblio/pdf/LFPDPPP.pdf
3. CNBV and Banxico. General Provisions Applicable to Credit Institutions. https://www.cnbv.gob.mx
4. Banco de México. Provisions applicable to SPEI and CoDi payment systems. https://www.banxico.org.mx/sistemas-de-pago/
5. Chambers Practice Guides (2026). Mexico — Cybersecurity, Privacy, and Data Protection Comparative Guide. https://practiceguides.chambers.com/practice-guides/comparison/1130/18603/29119-29120-29121-29122-29123-29124