Banxico's Nivel 2 Bis + the 4-Step Transfer Rule: What Your Checkout and Cobros App Must Change Before Dec 14, 2026
Banxico's mid-2026 rules (Circulars 9/2026 and 11/2026) do two things: they create a Nivel 2 Bis account micro-merchants can open online without an RFC (up to 15,000 UDIS/month in deposits, of which at most 3,000 may be cash), and they cap every mobile transfer at four steps. Nivel 2 Bis took effect the banking day after its June 2026 publication; institutions must comply with the four-step transfer rules by December 14, 2026.
On this page 7 sections
What changed in Banxico’s June 2026 payment rules?
In mid-June 2026 Banxico published two circulars in the DOF (June 17) that together do two things: Circular 11/2026, which amends Circular 3/2012 to create a new no-RFC merchant account tier called Nivel 2 Bis, and Circular 9/2026, which amends the SPEI rules (Circular 14/2017) and caps every transfer flow at four main steps. Nivel 2 Bis took effect the banking day after publication, in June 2026; the transfer-UX rules give institutions until December 14, 2026 to comply.
If you build for Mexican merchants, this is not a “bank problem” — it lands in your product. One change reshapes how you onboard micro-merchants; the other constrains the UX of any transfer flow you render. The stated goal is to reduce cash and standardize the digital-payment experience across institutions for the roughly 4.4 million small-merchant segment.
As of 2026, confirm the current figures and dates against Banxico’s published Circular before you ship anything against them — I’m an engineer, not a contador, so send the fiscal and legal edge cases to a compliance person. Let me decode each change, then turn it into an engineering checklist. For background on where these rails sit in the broader market, see my overview of payment gateways in Mexico.
What is Nivel 2 Bis, and who qualifies?
Nivel 2 Bis is a new deposit-account tier built for micro and small merchants — that ~4.4M-comercio segment that today often runs entirely on cash. The unlock is the onboarding: it can be opened online and without an RFC (the federal taxpayer ID). For an informal micro-merchant who has never filed with SAT, that removes the single biggest wall between them and a digital account.
The tradeoff for that low-friction opening is a set of caps. As published:
- Monthly inflow is capped at up to 15,000 UDIS per month.
- Of that, at most 3,000 UDIS may be cash deposits — the lever meant to push merchants off efectivo.
- The rest has to arrive through non-cash channels — CoDi, DiMo or SPEI. The Circular sets no separate digital minimum; the cash cap does the work.
Read those together and the design intent is obvious: the account is built to be mostly digital by construction. The 3,000-UDIS cash sub-cap sits inside the 15,000-UDIS monthly ceiling, so anything beyond 3,000 UDIS in a month has to come in through non-cash rails — not a minimum you must hit, just the room left once cash is capped.
One critical engineering note: UDIS is an inflation-indexed unit, not pesos. The Unidad de Inversión moves with inflation, so 15,000 UDIS is a different peso amount every day. Convert thresholds at the current UDIS value rather than hardcoding a peso figure, and confirm the exact numbers against the Circular (as of 2026, confirm current).
The 4-step transfer mandate, decoded
The second rule caps every bank and fintech transfer flow at a maximum of four main steps: authentication, data entry, validation, notification. That’s the whole budget — from the moment the user proves who they are to the moment they see “your transfer was sent.”
Reporting indicates Banxico goes beyond a raw step count: it standardizes the experience — a modelo estandarizado / experiencia homogénea — so the flow feels the same regardless of institution, and the homologation spans SPEI, CoDi and DiMo. The exact UI specifications (copy, field order, QR details) live in the Circular and its accompanying technical guidelines, so confirm them there before implementing. Treat the four-step cap as the floor of the requirement, not the ceiling.
Practically, for builders, this means:
- Collapse multi-screen detours. If you split “pick account” and “enter amount” across three screens with interstitials, you’re over budget.
- Pre-fill aggressively. Saved beneficiaries, last-used account, parsed CLABE — anything you can fill, you should.
- Don’t bolt on a confirmation interstitial that pushes you past four. Fold confirmation into the validation step.
Because the standardization spans SPEI, CoDi and DiMo, the experience is meant to feel identical across institutions. Audit your current flow now: count the screens from auth to notification, and cut anything that pushes you past four.
- 1. AuthenticationUser proves identity — biometric, PIN or device factor. One step, not a multi-screen gate.
- 2. Data entryAmount, beneficiary, concept. Pre-fill saved beneficiaries and last-used accounts; parse CLABE/QR.
- 3. ValidationShow what's about to happen and confirm here. Fold the confirmation into this step — no extra interstitial.
- 4. NotificationResult: sent, with reference/folio. CoDi/DiMo and SPEI all land on the same closing screen.
What your app actually has to change
Here’s the concrete before/after. None of this is exotic — it’s mostly removing friction you already built.
Onboarding. Add a no-RFC Nivel 2 Bis path for micro-merchants instead of forcing full KYC with RFC up front. Keep your higher tiers for merchants who outgrow the caps, but stop blocking the informal micro-merchant at step one.
Threshold-aware dashboards. Design onboarding and the merchant dashboard around the 3,000-UDIS cash cap. Surface, in real time, how much of the monthly inflow is digital versus cash so merchants don’t accidentally trip the cash cap and bounce a deposit.
Checkout and cobros. Make CoDi, DiMo and SPEI first-class payment methods, not an afterthought buried under cards. With cash capped at 3,000 UDIS, everything else a merchant takes in each month has to arrive digitally — so your checkout has to make digital cobros (the act of collecting payment) effortless.
Transfer UX. Refactor any flow longer than four steps. Map every screen to one of authentication, data entry, validation, notification — and delete the rest.
Enforce the limits in code. Track the monthly 15,000-UDIS inflow and the 3,000-UDIS cash sub-cap, recomputed at the live UDIS value. Treat the UDIS thresholds as config, not constants — they move with inflation and can be revised in the Circular, so a hardcoded peso number is a bug waiting to happen.
# Illustrative — thresholds come from config, fetched live, never hardcoded as pesos
udis = get_current_udis_value() # from Banxico; changes daily
limits = get_nivel2bis_thresholds() # sourced from config; verify vs the Circular
def check_inflow(month_digital_udis, month_cash_udis):
total = month_digital_udis + month_cash_udis
return {
"over_monthly_cap": total > limits.cap_monthly_udis, # 15,000 UDIS
"cash_over_subcap": month_cash_udis > limits.cash_subcap_udis, # 3,000 UDIS
"pesos_hint": round(total * udis, 2), # display only
}OLD model
- RFC required up front for any merchant account
- Onboarding is full KYC, branch or long form
- Transfer flow sprawls across 6+ screens
- Experience differs per app
- CoDi/DiMo treated as niche extras
NEW model (Nivel 2 Bis live; 4-step UX by Dec 14, 2026)
- Nivel 2 Bis opens online, no RFC
- Caps designed for mostly-digital inflow
- Transfer flow capped at 4 main steps
- Standardized, homologated experience
- CoDi/DiMo/SPEI are first-class cobros
A micro-merchant onboarding flow that fits the rules
Here’s the end-to-end happy path you can model your own flow on. Keep it vendor-neutral — this is the pattern, not a specific provider’s API.
- Open the account. The merchant opens a Nivel 2 Bis account online, no RFC required. This is the moment you’ve removed the biggest drop-off in micro-merchant onboarding.
- Wire the rails. You connect CoDi, DiMo and SPEI acceptance so inbound digital payments land directly in that account.
- Take digital cobros. The merchant collects payments digitally and stays within the 15,000-UDIS monthly cap, with no more than 3,000 UDIS of it in cash.
- Show a running meter. Display total received versus the 15,000-UDIS monthly cap, and cash received versus the 3,000-UDIS cash cap, both computed at the live UDIS value.
- Nudge before the bounce. If cash approaches its sub-cap, nudge the merchant toward digital cobros rather than silently letting the next cash deposit bounce.
Confirm each threshold against the live Circular and the current UDIS value before you enforce it. For the payout and onboarding plumbing behind these rails, my walkthroughs on integrating Mercado Pago and split payments for marketplaces cover the patterns end to end.
Does a 4-step rule actually push cash out? (honest take)
Opinion, labeled as such: the four-step cap is genuinely good UX. Capping the flow and homologating the experience lowers friction, and lower friction helps adoption at the margin. I’m in favor of it as a designer.
But I don’t think a transfer-screen cleanup moves the needle on cash by itself. Cash habits in Mexico run deeper than a confusing transfer screen — friction was never the only reason people reach for efectivo. Trust, informality, and the simple fact that the person across the counter also wants cash all weigh more than whether your flow has four screens or six.
The sharper lever is on the account side: the Nivel 2 Bis cash cap inside a 15,000-UDIS monthly ceiling. That’s economic pressure, not nicer screens. When the account itself is built to be mostly digital, and cash physically can’t exceed its sub-cap, behavior changes because the structure changes — not because a screen got simpler.
Net: the four-step rule nudges; the account-level caps and thresholds are what actually move volume off cash. As a builder, bet on making digital cobros effortless and on surfacing the thresholds clearly. Don’t expect step-count alone to change behavior.
FAQ
When is the deadline? December 14, 2026 for financial institutions to comply with Circular 9/2026 (the four-step transfer UX and its Guías). Nivel 2 Bis (Circular 11/2026) has no December date: it took effect the banking day after its June 2026 publication. Confirm current dates against Banxico’s published Circular.
Do merchants need an RFC for Nivel 2 Bis? No — it can be opened online without an RFC, which is the point of the tier.
How much can flow through Nivel 2 Bis? Up to 15,000 UDIS per month in deposits, of which at most 3,000 UDIS may be cash; the rest has to arrive through non-cash channels (as of 2026, confirm current figures).
Why UDIS and not pesos? UDIS is inflation-indexed. Convert at the current value and don’t hardcode a peso amount — treat it as config that moves.
Which rails count as digital? CoDi, DiMo and SPEI.
Where do I confirm the exact figures? Banxico’s marco normativo (Circular 11/2026, which modifies Circular 3/2012, for Nivel 2 Bis; Circular 9/2026, which modifies Circular 14/2017, for the transfer UX). Verify before you ship, and defer fiscal or legal edge cases to a contador. For background, see El Financiero’s coverage of Banxico’s new digital-payment rules.
