How a Company Buys Bitcoin in Mexico: Process and Paperwork

Summary: A company incorporated in Mexico can buy bitcoin from its own bank account and receive it in a wallet the company controls or in institutional custody. The process has five stages: an internal treasury policy, onboarding with verification of the entity and its beneficial owners (KYB), funding by SPEI, execution on an OTC desk, and delivery with reports. The operational side is governed by Mexico's anti-money-laundering law (LFPIORPI); the tax side follows general income-tax and Federal Tax Code rules, with no bitcoin-specific regime. This guide keeps the two apart and lists what the company must confirm with its provider and what belongs with its Mexican accountant. Facts as of September 2026.

What a Mexican company needs to buy bitcoin

The short answer: a company incorporated in Mexico (an S.A. de C.V., S.A.P.I. or S. de R.L., including a foreign-owned subsidiary), with a tax ID (RFC) and a bank account in its own name, can buy bitcoin through a provider registered with the SAT as an actividad vulnerable, pay by SPEI and receive the bitcoin at an address the company controls. No Mexican bank sells it: Banxico's Circular 4/2019 restricts banks and fintech institutions to internal operations with virtual assets and bars them from offering exchange, transfer or custody services to the public. Purchases therefore run through non-bank platforms operating under the LFPIORPI, not under a CNBV or Banxico licence.

If you are a foreign founder or CFO, note the scope: this guide covers the Mexican entity buying in Mexico. A parent company buying abroad follows its own jurisdiction's rules, and moving the asset between entities creates its own tax questions.

Compared with a personal purchase, the asset is the same; the paperwork triples:

• Who decides, who authorizes and who signs (governance).
• What the provider must collect to onboard the entity and its beneficial owners.
• What records the accountant needs to support the acquisition cost and the tax filings.

The guide follows that order. Accounting and income-tax treatment (NIF C-22, the corporate rate, VAT on fees, loss deduction) is already covered in the Bitcoin tax framework for corporations in Mexico; here we only list the questions to take to the accountant.

Before buying: the treasury policy

A treasury purchase starts with a written resolution, not with a platform login. Three decisions prevent most later problems.

Sizing. How much of cash or reserves goes into bitcoin, and over what horizon. Bitcoin is volatile, is not legal tender in Mexico and carries no Banxico backing or IPAB deposit insurance. The company should set an amount it can hold through price drops without touching payroll or supplier payments. The Bitcoin allocation framework is written for individuals, but its logic on horizon and liquidity applies to a treasury as well.

Cadence. A single purchase, recurring purchases, or purchases triggered by surplus cash flow. Cadence sets how many operations will need documenting and how often the books get reconciled.

Governance. Who proposes, who authorizes, who sends the SPEI transfer and who reconciles. These should be different people, and the board or partners' resolution should set per-transaction and per-period limits plus the required signatures. If the company self-custodies, the policy also states who holds the private keys (or the shares of a multisig), where the seed phrase (the backup that restores the wallet) is stored, and what happens when a key person leaves.

No statute requires these resolutions in these terms; practice does. An audit or an SAT review asks first for the authorization and the supporting documents behind each movement.

Operational process: how a purchase works with Aureo

The following describes Aureo's published business process and separates public facts from what must be agreed during onboarding. Before transferring, the company should obtain the document list, limit, price-fixing moment, timeline and delivered evidence in writing.

Onboarding: what the law requires

Aureo operates in Mexico through Soluciones Tecnológicas Nagumatech S.A.P.I. de C.V., registered with the SAT as a virtual-asset actividad vulnerable (LFPIORPI, article 17, section XVI). That section requires identification of every client, with no minimum, and a notice (aviso) to the Finance Ministry when a client's operation reaches 210 UMA (MX$24,635.10 at the 2026 UMA, an inflation-indexed unit used in Mexican law) or when the fee charged reaches 4 UMA (MX$469.24). Almost any corporate purchase clears both thresholds, so the company should assume its operation will be reported. The platform files the notice, not the company.

Article 18 of the same law lists what the platform must collect: identify and know the client from official documents, ask about its business activity and, when the client is a legal entity, obtain documents identifying its beneficial owner (beneficiario controlador), meaning the natural person who ultimately benefits from the operation or controls the company (article 3, section III). The current General Rules (article 12, section II) spell out the list for a Mexican legal entity:

• Corporate name, date of incorporation, business activity or corporate purpose, address, phone, email and RFC.
• A notarized copy of the articles of incorporation (acta constitutiva) with its Public Commercial Registry filing.
• The SAT tax-ID certificate (cédula de identificación fiscal) and a proof of address.
• Notarized powers of attorney for the legal representative, with each representative's official ID.
• Data and documents on the beneficial owner, where the company holds that information.

A useful head start: Mexico's Federal Tax Code (article 32-B Ter) already requires legal entities to obtain and keep, as part of their accounting records, information on their beneficial owners. A company that complies has most of what the platform will ask for. The platform in turn must keep the file for at least ten years (article 18, section IV). New General Rules (Acuerdo 115/2026, published in the Official Gazette on 7 August 2026) take effect on 30 November 2026 and tighten risk classification and beneficial-owner verification, so the list may grow.

Aureo publishes that it verifies identity with Sumsub and ComplyAdvantage and passed an anti-money-laundering compliance audit by Ferrer y Asociados, per its April 2026 disclosure. What it does not publish is the exact corporate document list; ask for it during the diagnosis.

Funding: SPEI from the company's account

Payment leaves the company's bank account for the CLABE assigned to its Aureo account, over SPEI, Mexico's real-time interbank transfer system. Two reasons the source must be the company's account and not a shareholder's. First, anti-money-laundering: the platform has identified one client and expects the funds to come from that client. Second, tax: Mexico's income-tax law (article 27, section III) requires deductible outlays above MX$2,000 to be paid through the financial system, and the company's bank statement is the simplest proof that the company itself paid.

Banxico sets no maximum SPEI amount; the cap the company sees is its bank's. SPEI normally credits within seconds and, per Aureo, the bank leg takes 1 to 10 minutes in most cases. For the peso leg, Aureo has worked with Nvio Pagos, an electronic-payment-funds institution regulated in Mexico, per its April 2026 disclosure.

Execution: the OTC desk

Corporate purchases go through Aureo's OTC desk, which takes orders from MX$200,000. As of September 2026 the published fee is 1.00% for tickets between MX$200,000 and MX$2,000,000, with a custom quote above that. There is no hidden spread or SPEI fee.

The bitcoin purchasing sequence is quote, confirmation by the company, receipt of the SPEI transfer, and settlement with evidence. On an OTC desk the price is agreed before execution rather than swept from an exchange's order book; for large amounts that avoids slippage, the gap between the price you see and the average price your order actually fills at. A detailed OTC-versus-exchange comparison can be found here.

Delivery: the company's wallet or multi-institutional custody (MIC)

Aureo does not hold client balances: pesos are converted on arrival and the bitcoin is sent to the address the company saved. There are two destinations:

• The company's own wallet. A hardware wallet or a multisig setup that requires two or more keys to move funds. The company controls the private keys and takes on the duty to safeguard them. An on-chain transaction usually gets its first confirmation within 10 to 60 minutes; Aureo states delivery normally lands within the hour and up to 24 hours.
• Multi-Institution Custody (MIC). Aureo offers it to companies and family wealth through Onramp: a 2-of-3 multisig vault whose three keys sit with independent institutions, in segregated vaults titled to the client. It is quoted separately.

A Bitcoin transaction cannot be reversed. Before the first large purchase, send a small one to the same address and confirm it arrives. Our article on evaluating Bitcoin custody options in Mexico compares the models and their risks.

Which records to keep

Mexico's Federal Tax Code (article 28) defines accounting records broadly: books and ledgers, working papers, bank statements and all documentation supporting income and deductions. They must be kept for five years from the filing of the related return (article 30), and longer when the transaction's tax effects continue, as with an asset still on the balance sheet. For bitcoin, a minimum file per operation:

1. Internal authorization (minutes, resolution or email) with amount and signatories.
2. The OTC quote and confirmation.
3. The SPEI receipt and the bank statement showing the debit.
4. The provider's peso-denominated report or summary with BTC amount, price and fee.
5. The Bitcoin transaction ID (TXID) and destination address, proving the company received and controls the asset.
6. A digital-asset subledger: date, BTC, MXN paid, fee, cumulative cost, balance and wallet.

The subledger format and the valuation policy are already laid out in the corporate tax framework article; this file is the input that feeds them.

General tax information: questions for the accountant

This section does not repeat the accounting treatment; it lists what stays open for the company's Mexican accountant. It applies to Mexico and to legal entities.

• Income and deductions. Mexico's income-tax law requires companies to accrue all income (article 16) and the gain from transferring property as payment (article 18, section II); authorized deductions (article 25) require a tax invoice and payment through the financial system (article 27, section III). Question: which document supports the bitcoin's acquisition cost if the seller issues no CFDI.
• CFDI. The Federal Tax Code (article 29) says whoever acquires goods must request a CFDI from the seller. Prodecon, the taxpayer ombudsman, opined in 2021 that the duty to issue it falls on whoever sells the virtual asset, using a generic RFC when the buyer is unknown; the opinion is not binding. Whether platforms issue CFDIs to legal entities, and under what concept, is not publicly settled. Ask the provider what it delivers and the accountant what is needed.
• Regime. If the company is taxed under the simplified RESICO regime for legal entities, the calculation and limits change. Our article on Bitcoin and RESICO in Mexico explains the regime for individuals and is a starting point; the legal-entity case belongs with the accountant.
• Exits. Article 119 treats barter as two disposals, and Prodecon interprets crypto sales under the general disposal rules; that is not a binding SAT position. Ask the accountant how to record sales, swaps and bitcoin payments. The property case is covered in Bitcoin and real estate in Mexico.
• Data reaching the SAT. As of September 2026 there is no automatic international exchange of crypto data that includes Mexico: the country has committed to the OECD's CARF framework with first exchanges in 2029, per the OECD list dated 14 September 2026. What does exist today is the anti-money-laundering notice described above. Foreign-owned subsidiaries should also ask whether the parent's jurisdiction imposes its own reporting.

Next step

If the company already has a treasury resolution and its beneficial-owner file, the next step is the diagnosis: review the goal, governance and documentation with Aureo and confirm which tax reports it will receive. The Aureo for businesses page describes the process and the contact; current fees are on the pricing page and the MIC custody option under Patrimonio.