Executive answer
A fintech combines authorization, capital, funding, technology, data, origination, risk decisions, collections and service. Returns should not be assigned only to the software owner or the lending entity. Transfer pricing should identify who controls each decision, contributes assets and has the financial capacity to bear losses.
Mexico’s Financial Technology Institutions Law forms part of the sector framework depending on the activity. Local authorization or supervision is relevant, but it does not automatically establish who creates value. It also does not replace analysis under the Income Tax Law, treaties, VAT, withholding or permanent-establishment rules.
The file should follow each product through onboarding, verification, scoring, pricing, funding, disbursement, monitoring, fraud, collection and closure. That connects the risk model, platform and accounts.
Regulatory and entity map
Identify the authorized entity, technology companies, lenders, payment providers, IP owners, service centers and funding vehicles. Record each activity, territory, supervisor, restriction, capital and agreement.
Do not use “fintech” as a single characterization. An electronic-payment institution, crowdfunding platform, aggregator, lender, software provider and marketplace perform different functions.
Separate regulatory compliance from intercompany remuneration. Satisfying capital or authorization requirements does not establish that a rate, fee or allocation is arm’s length.
Product value chain
Map acquisition, KYC, onboarding, underwriting, pricing, funding, servicing, payments, fraud, collections, complaints and data. Identify the system, team and decision authority at every step.
Separate loans, guarantees, licenses, SaaS, scoring, marketing, collection, support, data and corporate services. Avoid one “platform fee” invoice covering everything.
Segment credit, payments, wallets, merchants and other products where their economics and risks differ.
Funding and debt capacity
Before benchmarking a rate, delineate whether debt exists. Review the agreement, purpose, term, currency, subordination, repayment, collateral and the borrower’s capacity.
Identify who chooses volume, funding source, maturity and liquidity buffer. An entity funding Mexico may provide capital, perform treasury functions or control risk; those contributions require different returns.
Compare realistic alternatives such as eligible deposits, bank facilities, securitization, equity or related-party loans. Document credit rating, cash flow and covenants.
Do not confuse an arm’s-length rate with deductibility. Thin capitalization and interest limitations are separate tests.
Credit risk
Map who designs the score, approves policy, sets cutoffs, reviews exceptions, monitors the portfolio and changes collections. Distinguish the algorithm, data and decision authority.
Booking the provision in Mexico does not establish that Mexico controls risk. If the parent imposes criteria, analyze its participation; if a local committee decides with information and financial capacity, the profile may be broader.
Retain model versions, backtesting, overrides, minutes, vintages, defaults and recoveries. A generic process description does not explain the fiscal year.
Data, scoring and models
Identify source, consent, cleaning, features, training, validation and exploitation. Separate public, local, purchased and generated data.
The legal owner of code does not necessarily control the model. Document who chooses variables, accepts bias, approves changes and bears failures.
If Mexico generates performance data improving a global model, determine rights and remuneration. If it merely executes a closed tool, the answer may differ.
Platform and technology
Break down licenses, hosting, cloud, cybersecurity, releases, support, APIs and vendors. Prove use and benefit.
Characterize rights: access is not the same as a license to exploit copyright. Review treaty, withholding and VAT in addition to price.
Allocate cloud by consumption and support by tickets or another appropriate driver. Avoid duplicating technology in both royalty and service fees.
Zugzwang’s Fintech TP Risk Map connects authorization, products, funding, risk, data, platform and accounts before setting rates and charges.
Capital, regulation and return
Regulatory or economic capital supports risk and may constrain growth. Identify who contributes it, decides its use and receives the return. Do not compensate capital only through a technology fee.
Separate returns to capital, services and intellectual property. A model may require several charges, but it must avoid duplication.
Document restrictions on dividends, liquidity and related-party operations where applicable. Regulatory reality affects the alternatives actually available.
Payments and wallets
Map issuance, acceptance, acquiring, settlement, safeguarding, fraud, chargebacks and support. Identify who maintains accounts and controls funds.
Separate interchange, merchant discount, processing fees, FX and float. Each component reflects a different function and risk.
Reconcile transaction reports to revenue, balances and charges. Payment volume is not accounting revenue.
Origination and marketing
Determine who sets customer segments, offers, prices, promotions and channels. An affiliate referring leads earns a different return from one deciding underwriting and customer relationships.
Measure acquisition cost, conversion, approval, loss and lifetime value and reconcile those measures to accounting. Metrics explain; they do not replace statutory accounts.
Analyze brand and local relationships. Acquisition spending does not automatically create an intangible, but it provides evidence about functions.
Collections and servicing
Separate recordkeeping, statements, payment processing, early collections, legal collections and asset recovery. Record tickets, accounts and results.
Remuneration may use a per-account, transaction, cost-plus or recovery basis depending on comparables and risk. A fee on portfolio balance should reflect scope and portfolio quality.
Document who approves restructurings, write-downs and sales. Those decisions control loss outcomes.
Fraud, cybersecurity and operations
Map prevention, detection, authorization, investigation, customer compensation and insurance. Separate fraud from credit risk.
Identify who controls models and can block transactions. An incident may reveal conduct different from the agreement.
Central security charges require benefit, allocation and performance evidence; penalties do not automatically pass to an affiliate.
Methods
A CUP may test comparable rates or fees with appropriate adjustments. Cost plus may suit routine support. TNMM may test a service entity, while profit split may be considered for integrated unique contributions.
For loans, compare currency, term, rating, collateral, subordination and conditions. For licenses, compare rights and territory. For servicing, compare scope and portfolio.
Do not use one margin for credit, platform and collection activities where reliable separation is possible.
Segmentation and reconciliation
Segment by product, vintage, channel and function. Allocate technology, people, funding and losses using economic drivers.
Reconcile originations, portfolio, interest, fees, provisions, write-offs, recoveries and funding to accounts and returns.
Maintain a bridge among regulatory, management and accounting metrics because definitions can differ.
Operational TP
Monitor funding cost, spread, losses, approval, fraud, cloud, fees, cost pools and projected true-up. Set alerts for both economic deviation and data quality.
Bring risk, treasury, product, technology, finance, legal and tax together. Every material change to scoring, rate or product needs evaluation.
Preserve model versions and decisions. Do not reconstruct control only after a loss.
Liquidity, cash pooling and FX
Map operating accounts, reserves, concentrations, cash pools and transfers. Identify who determines minimum balances, investment, currency and hedging. A regulated entity may face restrictions changing realistic alternatives.
Separate the pool leader’s remuneration from depositor and borrower interest and liquidity benefits. Compare terms, guarantees and availability. Treat persistent balances as financing when they cease behaving commercially.
Reconcile accounting FX with treasury policy. Recording a loss in Mexico does not prove control. Document hedge decisions and beneficiaries.
Expected and realized losses
Distinguish ex ante pricing, expected loss, accounting provision, default, write-off and recovery. Each serves a different purpose. Arm’s-length analysis considers information available at origination and later decisions.
Compare vintages and segments. A new portfolio differs from a mature one. Explain model changes, macro assumptions and collection performance. Do not treat later outcomes as automatically foreseeable.
When loss exceeds forecast, bridge mix, volume, fraud, underwriting, operation, collections and external events. Assign control and action.
Corporate services and materiality
Inventory legal, compliance, AML, finance, HR, technology, risk and regional management. Record the activity, output, beneficiary, cost, key and markup for each.
Prove benefit and performance. A local regulatory requirement neither makes every central service duplicative nor permits unsupported charges. Separate shareholder activity and investment oversight.
Use drivers connected with consumption, such as transactions, accounts, cases, users, hours or assets. Reconcile invoices, withholding, VAT, trial balance and payment.
Model validation and governance
Maintain a model inventory with owner, purpose, version, data, approval, use, limitations and validation date. Include scoring, fraud, pricing and collection models.
Record overrides and their approver. Local authority to alter outcomes may evidence control; foreign approval requirements may show another allocation.
Independent validation should inform pricing and risk decisions. Retain findings, remediation and acceptance while minimizing personal data in the tax file.
Agreements and change control
Agreements should define products, rights, data, SLA, rates, fees, losses, guarantees, capital, termination and adjustments. Compare them with conduct.
Use change control for a new authorization, product, model, provider, funding source or country. Document the business rationale and tax impact.
Do not backdate agreements. Remediate prospectively and assess open periods on their facts.
Defense file and audit calendar
Include the regulatory chart, value chain, FAR, agreements, committee minutes, model references, funding, portfolio, data, platform, methods, comparables and reconciliation.
Sample loans, decisions, users and services. Protect personal data through minimization and access controls. Connect every figure with a source and owner.
Approve funding, loss and product assumptions before budgeting. Review spread, risk and liquidity monthly; models, allocations and agreements quarterly; and true-ups, withholding and VAT before close.
Management reporting
Give the CFO and risk committee a concise monthly bridge showing portfolio growth, funding cost, expected and realized loss, fraud, operating cost and intercompany charges. A separate data-quality score should identify late sources, unapproved overrides and unreconciled balances.
Report each recovery or adjustment as proposed, approved, invoiced, booked, paid and reflected by the counterparty. Those stages prevent an expected credit from being treated as completed compensation. Escalate any material gap with an owner and deadline.
Use a rolling view alongside monthly vintages. The rolling view shows sustainable economics, while vintage detail preserves the decisions and risk conditions that produced each result.
Illustrative example
The parent supplies funding and an algorithm, but the Mexican committee sets cutoffs, approves exceptions and changes collections using local data. It may be insufficient to compensate Mexico as routine support. Control of risk, capital, data and losses requires analysis.
If the parent decides and Mexico executes without authority to vary, routine remuneration may be coherent. Minutes and system permissions provide the evidence.
Conclusion
Fintech creates value by combining capital, licensing, technology, data and decisions. Separating them prevents a platform fee from absorbing returns attributable to risk or funding.
A product-level map supports rates and charges, explains losses and keeps policy, regulation and operations aligned. Management, risk, treasury and the board should be able to understand the result, not only tax specialists.
Request a Fintech TP Risk Map to map funding, risk, platforms, data and returns before launching or repricing a product.
Verified official sources
- Mexican Chamber of Deputies, current Financial Technology Institutions Law.
- Mexican Chamber of Deputies, current Income Tax Law, Articles 76, 179 and 180.
- OECD, Transfer Pricing Guidelines 2022, Chapters I, VI, VII and X.
Verification closed on August 2, 2026. Confirm authorization, product, financial regulation, agreements and applicable data.