1. 01

   Mexico publishes its 2027 federal revenue law

   The law published today estimates total federal revenue of 10,636,488.1 million pesos for 2027, including financing. Taxes account for 6,263,886.8 million pesos. These are budget estimates, not money already collected.

   Context

   Article 2 authorizes net domestic borrowing of up to 1.7 trillion pesos and net external borrowing of up to 13.5 billion US dollars. It allows substitution between the domestic and external borrowing limits.

   Why it matters

   Businesses can now distinguish the published revenue framework from a legislative proposal. The borrowing figures authorize financing; they do not show how much debt has already been issued.

   Read the sourcesDiario Oficial de la Federación ↗
2. 02

   Banxico changes how lenders advertise total annual credit costs

   Circular 14/2026, published today, revises the total annual cost indicator, or CAT. For products with at least 100 contracts originated in the relevant prior six months, advertising must use the 66th percentile of contract CAT values.

   Context

   For products with fewer than 100 contracts, lenders must use the 66th percentile of projected contract CAT values for the next six months. The rules cover banks and other specified credit providers, including debt-crowdfunding institutions.

   Why it matters

   The methodology also counts the cost of mandatory cash collateral using the overnight funding TIIE, net of interest paid to the customer. Lenders must disclose that collateral cost is reflected in the CAT.

   Read the sourcesDiario Oficial de la Federación ↗
3. 03

   Banxico sets cybersecurity requirements for cash-operation systems

   Circular 13/2026, published today, revises security requirements for banks using Banxico’s SIBUC, AUDI and SAM systems. Incidents affecting connection infrastructure or applications used with those systems must be reported within 30 minutes of identification.

   Context

   The rules require a follow-up report within 24 hours of identification and participation in cyber-resilience exercises when Banxico calls them. The scope is these systems and their connection infrastructure, not every bank system.

   Why it matters

   Banks remain responsible when designated cash-transport companies operate these systems on their behalf. The published annex requires documented controls, a security lead and operational-continuity arrangements; detailed technical requirements are distributed through the systems.

   Read the sourcesDiario Oficial de la Federación ↗

Coverage through 2026-11-13.