CNBV accepts SMS as banking authentication and simplifies balance inquiries

The National Banking and Securities Commission (CNBV), following an agreement by its Governing Board, published on September 1, 2026, in the Official Gazette of the Federation the resolution modifying the General Provisions applicable to credit institutions, in order to admit SMS text messages as a category 3 authentication factor and to simplify verification for balance inquiries. The regulation, signed on August 24, 2026, by the president of the CNBV, Ángel Cabrera Mendoza, will enter into force the day following its publication.

The resolution reforms articles 319 Bis 2, 319 Bis 3, and 319 Bis 5 of the provisions, originally published on December 2, 2005, and modified on various occasions. The change is supported by the Credit Institutions Law and the National Banking and Securities Commission Law, and responds to the objectives of the National Financial Inclusion Policy 2025-2030, which seeks to expand the coverage of financial services through secure digital channels.

Background: the technology-based agent

The reform is part of the regulation that, since July 11, 2024, incorporated the figure of the technology-based agent, which allows credit institutions to enter into commercial commission contracts with third parties acting in the name and on behalf of the institution before clients or potential clients, through their own websites or applications.

Within the client session, these agents may offer and execute the following operations:

• Opening of level 2 accounts and transfer of funds associated with said accounts.
• Granting of credits for amounts not exceeding three thousand UDIs.
• Payments for goods and services.
• Inquiries of balances and movements of the financial products and services contracted through said agents.

SMS as a category 3 authentication factor

Until now, the regulation required that the category 3 authentication factor be delivered to the client via email or through an instant messaging service with encrypted communication protocols, without considering SMS text messages. With the reform, the client may provide a mobile phone number enabled for the reception of SMS text messages as a means of contact, through which the institution’s technological infrastructure will send one of the category 3 authentication factors.

The regulation also provides that the client may modify both their category 2 authentication factor and the means of contact, for which the agent’s website or application must have an explicit, clear, and visible option or link that redirects to the institution’s technological infrastructure.

Simplified verification in balance inquiries

As an exception, the resolution establishes that, for the operation of querying balances and transactions of financial products and services contracted through agents, institutions may require only the category 2 authentication factor defined by the customer, without the need to request the category 3 factor. This simplification reduces friction in lower-risk operations and facilitates access to financial information.

The measure expands digital financial inclusion by allowing millions of users of technological agent banking to access their balances and transactions through a more accessible verification mechanism, without depending on email or encrypted messaging applications.

Source: Official Gazette of the Federation, Publication No. 238/2026, Tuesday, September 1, 2026, pgs. 4-5 (official reference: Resolution modifying the General Provisions applicable to credit institutions).