Where did the MTU come from and why is the Mexican government demanded in bank apps?

The origin of the creation of the MTU

On June 14, 2024, the Official Gazette of the Federation (DOF) published a resolution that modifies the way in which credit institutions operate, with the aim of strengthening the supervision of multiple banking in terms of prevention, detection and timely response to fraud.

That is, the CNBV updated the regulations so that banks have more tools to combat this crime, in which they include that every institution has a “management plan for fraud prevention”.

However, one of the most highlighted measures was the creation of the user transactional amount (MTU), since it directly affects the bank user or customer. According to the official provision, the main objective is to establish limits of financial movements of an account.

This document was the result of changes made by the National Banking and Securities Commission (CNBV), an organ of the Ministry of Finance and Public Credit (Finance), responsible for protecting the stability and proper functioning of the Mexican financial system.

It also incorporated the definition of “observable behaviors for external or internal fraud”, and those that can be those that tend to:

a) supplant or usurp the user’s identity;

b) steal your personal data and financial information;

c) supplant the identity of the credit institution;

d) the use of privileged information of users (by employees of credit institutions);

e) Commit the electronic media used by the user by installing a malicious code capable of altering the performance of monetary operations, or

f) Alter check and emit false checks.

The The Ministry of Finance reported that cyber frauds are a growing threat in Mexico since its incidence grew 40% between 2018 to 2024. Phishing was the most common mechanism, which consists in stealing personal information or digital identity such as passwords or bank data.

How will the MTU help combat fraud?

According to a subsequent analysis carried out by BBVA, the MTU is applicable only for natural persons, and will be determined by the same user, or failing that, by the financial institution based on their transactional behavior.

“The MTU will be used for the detection of operations that depart from the usual parameters of use and, where appropriate, prevent fraud,” said BBVA analysts.

When people establish their MTU in their banking applications or tools, they are recognizing that their financial operations are normally subject to such amounts, so anyone who tries to do it can be suspicious.

In that sense, financial institutions may request an additional self -identification factor for mobile banking, instant messaging or email, with encryption protocols, to ensure that it is a genuine operation, carried out by the holder of the account, and not a third.

Can you change the MTU once established?

Yes. The rule provides that it can be modified without the need to be face -to -face. That is, it can be made from the bank’s application, but it will require two authentication factors.

And as a security measure, the bank will alert the client with encryption protocols. The change must also be confirmed, or will not take effect.

Deadline to establish the MTU

The DOF explained that multiple banking institutions will have until October 1, 2025 to determine the MTU.

There are currently three key dates For bank users to be considered regarding this topic:

September 30, 2025: Deadline to voluntarily configure your personalized limit.

October 1, 2025: Banks must enable the option to define the MTU on their applications and digital platforms.

January 1, 2026: The MTU will be mandatory for all digital banking customers.