MTU: New Transaction Limits in Digital Banking Enter Critical Phase Ahead of 2026

Banks in Mexico are fast-tracking the implementation of the User Transaction Threshold (MTU, for its initials in Spanish), a parameter that will establish personalized limits for transfers made by individuals through banking apps and online portals. The measure, designed by the National Banking and Securities Commission (CNBV), is aimed at strengthening fraud prevention and is entering a decisive stage in the last quarter of 2025, leading up to its mandatory adoption starting January 1, 2026.

The MTU stems from amendments published in the Official Gazette of the Federation on June 14, 2024, to the regulations applicable to multiple banking institutions. The changes require banks to have anti-fraud management plans in place and to identify observable risk behaviors such as identity theft, data breaches, misuse of internal information, or device compromise. This regulatory adjustment is in response to a surge in cyber fraud in the country: the Finance Ministry reported a 40% increase between 2018 and 2024, with phishing as the predominant vector.

How does it work? The MTU applies to individual users and serves as a reference threshold based on the customer’s typical transaction behavior. It may be defined by the user themselves or, if omitted, be assigned by the bank according to usage patterns. When a transaction attempts to exceed that limit, the bank triggers additional controls—such as extra authentication factors and secure channel validations—to ensure the instruction is genuine before processing.

The regulation allows the MTU to be adjusted remotely without the need to visit a branch. Changes must be carried out within the app or online banking portal, require at least two factors of authentication, and need an explicit confirmation before taking effect. In addition, banks must notify the customer through encrypted channels every time a limit modification is attempted or an unusual transaction is detected relative to their usage profile.

The rollout includes three key dates for digital banking users: September 30, 2025, is the deadline to voluntarily set up a personalized MTU; October 1, 2025, is when banks must enable the option to define it via their platforms and assign limits based on behavior if the user does not do so; and January 1, 2026, is when the MTU will become mandatory for all individuals using digital services.

For end-users, the expected benefit is a reduction in the risk of unrecognized charges and unauthorized transfers, in exchange for possible friction when making high-value or infrequent transactions. Individuals with business activities or irregular cash flows may require higher limits or specific adjustments before extraordinary payments. The operational key will be early communication from banks and an easy, secure way to modify the MTU.

For financial institutions, the MTU means investing in transaction analytics, robust authentication, and real-time monitoring, in addition to fine-tuning models to minimize false positives that could affect the user experience. While the mandate applies to traditional banks, it is expected that other players—such as fintech companies partnering with sponsoring banks or other regulated entities—will adopt similar controls to ensure consistency throughout the payment ecosystem, especially for transactions routed through SPEI.

This rollout is taking place in a context of rapid digitalization of payments and financial services in Mexico, with greater use of instant transfers, expansion of mobile banking, and an environment of still high—though gradually lowering—interest rates. Trust and security in digital channels have become central to sustaining financial inclusion, formalizing micro and small businesses, and ensuring the operational continuity of supply chains boosted by nearshoring.

Looking ahead to 2026, the sector will keep a close eye on effectiveness metrics (reduction in fraud, authentication times, abandonment rates) and potential fine-tuning by the CNBV. Also set to become more relevant are the adoption of biometrics, the updating of client contact information, and the interoperability of alerts among banks to bolster the response to coordinated fraud attempts.

In summary, the MTU is a user-centered risk control designed to raise the barrier against fraud without hindering the transition to digital payments. Its success will depend on striking a balance between security and usability, on effectively educating customers, and on banks’ technological capability to dynamically adjust limits in line with each individual’s transaction profile.