Banxico's Nivel 2 Bis + the 4-Step Transfer Rule: What Your Checkout and Cobros App Must Change Before Dec 14, 2026

What changed in Banxico’s June 2026 payment rules?

In mid-June 2026 Banxico published Circular 9/2026, which modifies the existing SPEI/CoDi framework (Circulars 3/2012 and 14/2017) and does two things at once: it creates a new no-RFC merchant account tier called Nivel 2 Bis, and it caps every transfer flow at four main steps. Institutions have until December 14, 2026 to comply.

If you build for Mexican merchants, this is not a “bank problem” — it lands in your product. One change reshapes how you onboard micro-merchants; the other constrains the UX of any transfer flow you render. The stated goal is to reduce cash and standardize the digital-payment experience across institutions for the roughly 4.4 million small-merchant segment.

As of 2026, confirm the current figures and dates against Banxico’s published Circular before you ship anything against them — I’m an engineer, not a contador, so send the fiscal and legal edge cases to a compliance person. Let me decode each change, then turn it into an engineering checklist. For background on where these rails sit in the broader market, see my overview of payment gateways in Mexico.

What is Nivel 2 Bis, and who qualifies?

Nivel 2 Bis is a new deposit-account tier built for micro and small merchants — that ~4.4M-comercio segment that today often runs entirely on cash. The unlock is the onboarding: it can be opened online and without an RFC (the federal taxpayer ID). For an informal micro-merchant who has never filed with SAT, that removes the single biggest wall between them and a digital account.

The tradeoff for that low-friction opening is a set of caps. As published:

• Monthly inflow is capped at up to 15,000 UDIS per month.
• Of that, at least 12,000 UDIS must come from digital payment methods — CoDi, DiMo or SPEI.
• Cash deposits are capped (reported around 3,000 UDIS — verify in the Circular), the lever meant to push merchants off efectivo.

Read those three together and the design intent is obvious: the account is built to be mostly digital by construction. The reported 3,000-UDIS cash sub-cap and the 12,000-UDIS digital minimum sit inside the 15,000-UDIS monthly ceiling, so they aren’t a free-standing sum — they’re two sides of the same nudge toward digital.

One critical engineering note: UDIS is an inflation-indexed unit, not pesos. The Unidad de Inversión moves with inflation, so 15,000 UDIS is a different peso amount every day. Convert thresholds at the current UDIS value rather than hardcoding a peso figure, and confirm the exact numbers against the Circular (as of 2026, confirm current).

The 4-step transfer mandate, decoded

The second rule caps every bank and fintech transfer flow at a maximum of four main steps: authentication, data entry, validation, notification. That’s the whole budget — from the moment the user proves who they are to the moment they see “your transfer was sent.”

Reporting indicates Banxico goes beyond a raw step count: it standardizes the experience — a modelo estandarizado / experiencia homogénea — so the flow feels the same regardless of institution, and the homologation spans SPEI, CoDi and DiMo. The exact UI specifications (copy, field order, QR details) live in the Circular and its accompanying technical guidelines, so confirm them there before implementing. Treat the four-step cap as the floor of the requirement, not the ceiling.

Practically, for builders, this means:

• Collapse multi-screen detours. If you split “pick account” and “enter amount” across three screens with interstitials, you’re over budget.
• Pre-fill aggressively. Saved beneficiaries, last-used account, parsed CLABE — anything you can fill, you should.
• Don’t bolt on a confirmation interstitial that pushes you past four. Fold confirmation into the validation step.

Because the standardization spans SPEI, CoDi and DiMo, the experience is meant to feel identical across institutions. Audit your current flow now: count the screens from auth to notification, and cut anything that pushes you past four.

What your app actually has to change

Here’s the concrete before/after. None of this is exotic — it’s mostly removing friction you already built.

Onboarding. Add a no-RFC Nivel 2 Bis path for micro-merchants instead of forcing full KYC with RFC up front. Keep your higher tiers for merchants who outgrow the caps, but stop blocking the informal micro-merchant at step one.

Threshold-aware dashboards. Design onboarding and the merchant dashboard toward the 12,000-UDIS digital threshold. Surface, in real time, how much of the monthly inflow is digital versus cash so merchants don’t accidentally trip the cash cap and bounce a deposit.

Checkout and cobros. Make CoDi, DiMo and SPEI first-class payment methods, not an afterthought buried under cards. Merchants can only hit the 12,000-UDIS digital minimum if your checkout makes digital cobros (the act of collecting payment) effortless.

Transfer UX. Refactor any flow longer than four steps. Map every screen to one of authentication, data entry, validation, notification — and delete the rest.

Enforce the limits in code. Track the monthly 15,000-UDIS inflow and the reported ~3,000-UDIS cash sub-cap, recomputed at the live UDIS value. Treat the UDIS thresholds as config, not constants — they move with inflation and can be revised in the Circular, so a hardcoded peso number is a bug waiting to happen.

# Illustrative — thresholds come from config, fetched live, never hardcoded as pesos
udis = get_current_udis_value()        # from Banxico; changes daily
limits = get_nivel2bis_thresholds()    # sourced from config; verify vs the Circular

def check_inflow(month_digital_udis, month_cash_udis):
    total = month_digital_udis + month_cash_udis
    return {
        "over_monthly_cap": total > limits.cap_monthly_udis,        # ~15,000 UDIS
        "digital_target_met": month_digital_udis >= limits.digital_min_udis,  # ~12,000 UDIS
        "cash_over_subcap": month_cash_udis > limits.cash_subcap_udis,        # ~3,000 UDIS
        "pesos_hint": round(total * udis, 2),  # display only
    }

A micro-merchant onboarding flow that fits the rules

Here’s the end-to-end happy path you can model your own flow on. Keep it vendor-neutral — this is the pattern, not a specific provider’s API.

1. Open the account. The merchant opens a Nivel 2 Bis account online, no RFC required. This is the moment you’ve removed the biggest drop-off in micro-merchant onboarding.
2. Wire the rails. You connect CoDi, DiMo and SPEI acceptance so inbound digital payments land directly in that account.
3. Take digital cobros. The merchant collects payments digitally and works toward the 12,000-UDIS digital share of the 15,000-UDIS monthly cap.
4. Show a running meter. Display digital received versus the 12,000-UDIS target, and cash received versus the reported ~3,000-UDIS cap, both computed at the live UDIS value.
5. Nudge before the bounce. If cash approaches its sub-cap, nudge the merchant toward digital cobros rather than silently letting the next cash deposit bounce.

Confirm each threshold against the live Circular and the current UDIS value before you enforce it. For the payout and onboarding plumbing behind these rails, my walkthroughs on integrating Mercado Pago and split payments for marketplaces cover the patterns end to end.

Does a 4-step rule actually push cash out? (honest take)

Opinion, labeled as such: the four-step cap is genuinely good UX. Capping the flow and homologating the experience lowers friction, and lower friction helps adoption at the margin. I’m in favor of it as a designer.

But I don’t think a transfer-screen cleanup moves the needle on cash by itself. Cash habits in Mexico run deeper than a confusing transfer screen — friction was never the only reason people reach for efectivo. Trust, informality, and the simple fact that the person across the counter also wants cash all weigh more than whether your flow has four screens or six.

The sharper lever is on the account side: the Nivel 2 Bis cash cap plus the 12,000-UDIS digital requirement. That’s economic pressure, not nicer screens. When the account itself is built to be mostly digital, and cash physically can’t exceed its sub-cap, behavior changes because the structure changes — not because a screen got simpler.

Net: the four-step rule nudges; the account-level caps and thresholds are what actually move volume off cash. As a builder, bet on making digital cobros effortless and on surfacing the thresholds clearly. Don’t expect step-count alone to change behavior.

FAQ

When is the deadline? December 14, 2026 for financial institutions to comply with Circular 9/2026. Confirm current dates against Banxico’s published Circular.

Do merchants need an RFC for Nivel 2 Bis? No — it can be opened online without an RFC, which is the point of the tier.

How much can flow through Nivel 2 Bis? Up to 15,000 UDIS per month, with at least 12,000 UDIS from digital methods and cash capped at a reported ~3,000 UDIS (as of 2026, confirm current figures).

Why UDIS and not pesos? UDIS is inflation-indexed. Convert at the current value and don’t hardcode a peso amount — treat it as config that moves.

Which rails count as digital? CoDi, DiMo and SPEI.

Where do I confirm the exact figures? Banxico’s marco normativo (Circular 9/2026, which modifies Circulars 3/2012 and 14/2017). Verify before you ship, and defer fiscal or legal edge cases to a contador. For background, see El Financiero’s coverage of Banxico’s new digital-payment rules.