AI in banking and lending in Mexico: the use case to start with and the one to defer
An internal assistant for regulations, products and procedures for bankers and branches, with a permissioned knowledge base and an audit log. It never scores credit.
High value, available data, no decisions about people
An internal assistant for regulations, products and procedures for bankers, branches and distributors: it searches circulars, manuals and policies, cites the source and leaves a record. No customer data in training and no decisions about people.
Automated credit scoring and collections: decisions about people, with a right to object under Mexico’s data protection law and oversight by Condusef.
What is already happening in the sector
Conversational agents with customers, collections with synthetic voices and facial biometrics required by banking rules since July 1, 2026 (CNBV, Official Gazette). The Bank of Mexico’s Financial Stability Report of June 2026 calls for explainability, independent model audits, vendor oversight and human appeal, and documented eight cyber breaches at financial institutions between January and May 2026.
What the committee will review
Data the first use case touches
Internal documents: regulations, products, procedures. No customer files.
Regulator and obligation
The Single Banking Circular (articles 318, 326 and 328, with the CNBV’s 2022 cloud computing guide) requires prior authorization when processing happens outside Mexico and notice when it happens in the country, with a contract that grants the National Banking and Securities Commission (CNBV) access, audits at least every two years and records kept in Mexico. Hardware on your site avoids the prior authorization.
Who decides the purchase
Head of technology or data, with information security and compliance; in non-bank lenders, the CEO.
Deployment option
A by default. C (hardware placed on your site) as a third party with notice and a contract under article 318.
What financial services leaders ask
Can a bank in Mexico use a language model in the public cloud?
If data is processed outside the country, the Single Banking Circular requires prior CNBV authorization; inside the country, notice and a contract that grants the Commission access. For sensitive and confidential data, a model inside the bank’s perimeter avoids the authorization and keeps records in Mexico.
What does the CNBV require from an AI vendor?
The same as from any third party with access to information: a contract with access, audit and confidentiality clauses; a risk assessment; records kept in Mexico; periodic audits. There is no AI-specific circular; rules apply by analogy, and the governance evidence file is what the committee reviews.
Other industries: Insurance · Telecom and media · Fintech and payments · Auto finance
Discovery sessions, no commitment
With technology, compliance and two process owners. Includes an offline demonstration prepared for your sector, without using your company’s data.
Inventory and obligations
Data in four levels and a first review of what your sector requires.
Three candidate use cases
And the Assessment proposal. The Discovery is credited against the Assessment.
Founding clients program
Three seats, with an explicit discount in exchange for a publishable case and a reference.
Terms
Discovery and evidence pilot at no cost, Assessment at a discount, in exchange for a publishable case, a reference and feedback. Continuous operation is always paid at list price.