Mexico Strengthens Digital Banking Security: MTU to Become Mandatory in Banking Apps Starting October 2025
Starting October 1st, 2025, all banks in Mexico will be required to enable a User Transactional Amount (MTU, for its acronym in Spanish) configuration feature within their mobile apps and web platforms. This parameter will allow each customer to set personalized limits for digital transfers and payments. The measure, included in the Comprehensive Banking Circular issued by the National Banking and Securities Commission (CNBV) and published in the Federal Official Gazette in June 2024, aims to reduce fraud and improve the management of operational risk in an increasingly digital payment environment.
The MTU functions as a “lock” defined by the user: customers can establish daily, weekly, or monthly caps for transactions involving third parties, including SPEI and CoDi transfers, service payments, and transfers to new or external accounts. If a transaction exceeds the configured limit, the bank must either block it or subject it to additional validations. If customers do not set their MTU before September 30th, 2025, the bank will automatically assign a default limit equivalent to 1,500 UDIs. Because the UDI is indexed to inflation, the amount in pesos will vary over time.
The adoption of the MTU comes at a time when electronic payments are surging in Mexico, driven by digital banking growth, the increasing penetration of mobile phones, and wider adoption of systems like SPEI. At the same time, regulators and financial institutions have ramped up efforts to combat fraud via identity theft, phishing, smishing, and SIM swapping scams. The new system is designed to reduce high-impact risk events: even if criminals obtain a user’s credentials, daily or weekly caps can prevent large unauthorized withdrawals and high-value purchases.
For banks, this change will require technology upgrades and a revamped user experience: the option to set and modify the MTU must be clear, accessible, and auditable, with full traceability for compliance and risk management departments. Some banks have already begun rolling out this feature in their apps, helping customers get a head start on the learning curve. The CNBV expects this control to coexist with other security mechanisms such as biometric authentication, dynamic tokens, push notification confirmations, and monitoring for unusual activity patterns.
Practically speaking, setting a low MTU can be beneficial for users who regularly make small transactions, while those handling payroll, tax, or vendor payments may prefer higher limits or to temporarily adjust the MTU when making large transfers. The key will be to calibrate the cap according to actual usage habits and to review its relevance periodically. For exceptional transactions, customers will be able to temporarily raise their MTU and lower it again afterward.
Small and medium-sized businesses, which have accelerated digital payment adoption to improve cash flow and transaction traceability, will need to incorporate the MTU into their internal policies. Establishing limits by type of operation or recipient account can provide an extra layer of control, complementing function segregation and dual-authorizations. However, setting excessively restrictive caps may cause operational friction at month-end or during busy periods, so an initial phase of fine-tuning is expected in the early months of implementation.
From a consumer perspective, the MTU offers greater control without removing app functionality. While it's not mandatory for the user to set a limit, banks are required to provide the option. If a personalized limit is not set, the default value in UDIs will apply, but customers can change it at any time. Experts recommend documenting any limit changes and activating real-time alerts to detect out-of-pattern transactions, as well as consulting their bank for steps to adjust the MTU in each app, since the interface and terminology may vary by institution.
On the regulatory front, the MTU aligns with the authorities’ efforts to strengthen confidence in digital payments and protect financial consumers, in parallel with the fintech ecosystem’s evolution and the gradual adoption of open banking models. If widely adopted, the measure could help reduce complaints about unrecognized charges and enhance the perception of security—an important factor in displacing cash usage and broadening the formalization of economic activity.
In summary, implementation of the MTU introduces a new self-management risk tool for individuals and businesses, with the potential to mitigate fraud losses and bolster trust in digital banking. Its effectiveness will hinge on clear bank implementation, customer financial education, and integration with other controls. User-centric design and a gradual adjustment phase will be critical to improving security without slowing electronic payment adoption.
Final note: The MTU is an incremental advance, not a stand-alone solution. Properly calibrated—and paired with robust authentication, transactional monitoring, and user education—it can reduce high-impact events without hindering operations. The key will be balancing security and convenience, with close attention to fraud metrics and customer experience following its mandatory adoption in 2025.
