Fraud regulation, tracked

Biometric verification is required for higher-risk in-person operations on Level 3 and Level 4 accounts. Biometric databases may not be shared, sold or transferred without CNBV authorisation; vendors may operate the systems but the institution retains data governance. Technical specifications sit in Anexo 71. Institutions already running biometric databases had 30 calendar days to notify CNBV, and must give 20 business days' notice to discontinue one.

Beyond the MTU itself: automated alerting on deviations from the user's typical pattern including consumption and geolocation (Art. 316 Bis 13); a formal board-level fraud prevention plan (Art. 164 Bis 1) with biennial effectiveness audit; and 48-hour refunds on monetary claims (Art. 310). This is why Mexican banks began step-up-authenticating or blocking above-limit transfers from January 2026.

The burden of proof is reversed under 'carga dinamica de la prueba': the institution must evidence the specific identity-verification mechanism it used. Fraud teams must therefore retain per-application verification artefacts — document checks, liveness, device, biometric match scores — for as long as a claim can be raised. Victims have 20 business days to file a Fiscalia report after notifying the institution.

Build a reimbursement case workflow with two conditions on the consumer — report to police and notify the PSP without undue delay — and a refund clock. Reported refund deadline is 15 business days from notification plus police report. The burden of proof sits with the PSP to show consumer fraud or gross negligence in order to escape liability, so authentication, device and behavioural evidence must be retained per case, not just the transaction ledger.

Implement chain-tracing via DICT and GRAF with multi-layer blocks rather than first-hop only. Receiving PSPs have up to 7 days to accept or reject an Infraction Notification and up to 72 hours after analysis to request the refund. A self-service contestation button in the app has been mandatory since October 2025.

A fraud team operating in more than one of these markets should build one reimbursement-case engine with per-country clocks and thresholds, rather than four separate ones. The second convergence is scheme-level fraud markers on destination identifiers — Pix infraction notifications, Bre-B llaves, SPEI — making alias reputation a shared regional control surface.

Operate a 5-business-day auto-restitution lane below the threshold and a separate evidence-backed lane above it, plus a documented suspension and self-fraud workflow able to survive juzgado de policia local review. The transaction log alone is expressly insufficient to prove authorisation or user fault, so device, behavioural and authentication evidence must be retained. Ley 21.673 moved the threshold out of the statute: Hacienda now sets it annually by decree within a 15-35 UF band, so re-check it every year.

Onboarding flows must integrate the mandatory lookup, block on a hit, and log the consultation for supervisory review. This is the single clearest mule-account control in the Brazilian package and the one most likely to require an onboarding architecture change rather than a rule tweak.

Requires a real-time destination-account risk check inside the payment path, covering checking, savings and prepaid payment accounts — plus a defensible evidentiary standard for what constitutes 'founded suspicion', since a wrongful rejection is itself a customer-harm event.

Integrate VoP across every customer channel — online banking, mobile app and API — with the result shown before the payer can initiate. Payment is never blocked: on 'close match' or 'no match' the payer may proceed, and doing so after a warning shifts liability for a misdirected transfer onto the payer. Non-consumer payers may waive the service and opt back in. Expect sub-second response times including in bulk scenarios, and update T&Cs accordingly.

Wire fraud markers into both the transaction path and the key-registration path, and maintain a process to justify and contest markings. Enforcement is backed by daily fines and participant suspension.

Where the check is not performed and the payment goes astray, the payer's PSP refunds without delay, with a right of recourse against the payee's PSP or the payment initiation service provider where the failure was theirs. Reported to apply 27 months after entry into force — six months later than the rest of the PSR.

Note the data-sharing provision is permissive, not mandatory — PSPs 'may' exchange information. Sources indicate retention of up to five years after an incident. The monitoring obligation is mandatory and behaviour-based, which in practice means device and behavioural signals alongside rules. No EBA Level 2 RTS dates for transaction monitoring, fraud data sharing or IBAN-name matching have been published in any source checked.