AI at a Mexican Lender: Who Approves and How to Prove It

In short: At a SOFOM, a Mexican non-bank lender, AI helps you answer applicants sooner, place each loan at a lower cost and reach customers before a payment comes due. It builds loan files, payment profiles and alerts. Approving a loan, authorizing a restructuring or reporting a transaction to the UIF, Mexico's financial intelligence unit, stays with an authorized person, and every step is logged.

This article is for the board and leadership of a SOFOM, regulated or unregulated, heading into 2027 planning with AI projects on the table.

The cost of waiting shows up in the business first. The applicant who waits a week for an answer signs with whoever replied sooner. The loan officer chasing paperwork places fewer loans a month on the same salary. And the account you only call once it is past due costs more to recover. The regulator's review comes later.

The topic is already on senior finance leaders' agenda: the LIV IMEF National Convention 2026, Mexico's main gathering of finance executives, lists «Data, IA y Capital Inteligente» (data, AI and smart capital) and «Gobernanza en PYMES» (governance in small and mid-sized companies) among its themes. In AI from the boardroom chair we covered what any board decides before approving a project. Here we go down to the SOFOM, where oversight exists long before AI shows up.

Where it shows up in money: six uses at a SOFOM

In all six, the system prepares and an authorized person decides. What changes is what gets prepared and who decides.

• Fast credit analysis. The system assembles the file and calculates repayment capacity under your current policy. Answering an applicant sooner is a commercial edge: in lending, the first to reply often wins the customer. Approval still belongs to whoever your credit manual authorizes.
• Granular risk by customer, segment and vintage. Leadership sees deterioration by vintage (loans placed in the same month), by segment and by customer, in time to adjust. If the data suggests changing a term, an amount or an accepted profile, the system proposes it and Risk authorizes it.
• Payment profiles. Repayment behavior inside your own portfolio is combined with the Buró de Crédito or Círculo de Crédito report the customer authorized you to pull. Article 28 of Mexico's credit bureau law requires that express authorization; the system stores it with the file and never pulls a report without it.
• Preventive collections. Contact starts before the due date and is ranked by risk: accounts most likely to fall behind come first. The system logs every promise to pay and respects the collection hours set by CONDUSEF, Mexico's financial consumer protection agency. Payment agreements and restructurings are still negotiated and authorized by a person.
• Risk-based prospecting. Scoring prospects before they apply raises conversion and lowers the cost of each loan placed. Pre-screening is not a rejection: anyone who doesn't pass the filter can still apply and is assessed the normal way.
• Data governance and analytics for leadership. Profitability and deterioration by segment on a single dashboard. It works when every figure has an owner and a definition: if Collections and Risk count past-due loans differently, the dashboard blends two numbers that can't be compared.

AI enters a regime that already exists

At a SOFOM, AI inherits the rules, committees and supervisors already in place: there is no need to invent a separate regime for it. Which regime depends on the type of SOFOM. Under article 87-B of the LGOAAC, Mexico's law on credit organizations, a regulated SOFOM (E.R.) has an equity link to a bank or another financial entity, issues debt listed in the National Securities Registry or was approved as such, and is supervised by the CNBV, the banking regulator. An unregulated SOFOM (E.N.R.) answers to the CNBV only on anti-money laundering (AML) and to CONDUSEF on registration and consumer protection. Both must report their loans to at least one credit bureau.

Our view: the most common mistake is treating the AI project as a separate front, with its own committee and its own policy, while the real risk stays in the process that was already supervised. Two rulebooks over the same decision don't make it safer. They make it harder to audit.

Which decisions stay with your people, and why

Decisions that commit money or cannot be undone are made by a person; the work leading up to them can be delegated. A system could make them: models that score loan applications have existed for years. There are two reasons not to leave it on its own.

The first is the scale of the error. When an analyst gets it wrong, it is one file. When a system is poorly calibrated, it approves or rejects every similar application the wrong way, and that surfaces only once the loans are already in the portfolio.

The second is who answers for it. When a loan goes delinquent, when the CNBV reviews a file or when a customer complains to CONDUSEF, the institution has to answer who decided, with what information and under which policy. That responsibility can't be handed to a system. So decisions are split by what a mistake costs:

• Reversible: requesting a missing document, sending a payment reminder, rescheduling a call. The system executes it and it is logged.
• Costly to fix: proposing a restructuring or a payment agreement. The system prepares the proposal with its data and the manager approves or adjusts it.
• No way back: approving a loan or rejecting it for good. The analyst or the committee decides, as today, with the file the system left complete.

That is how one of the use cases on our financial services page works, a real, anonymized project: the loan file moves through intake, screening, completion, committee and archiving, with reminders that chase missing documents and two mandatory human decisions along the way.

Gartner describes the same risk on a global scale: in a May 26, 2026 press release it predicts that by 2027, 40% of enterprises will demote or decommission autonomous agents because of governance gaps found after an incident, and recommends governing each one according to its level of autonomy.

Real human control: the committee also sees the declines

If the committee only sees complete files with their traffic light, and never the declines or the borderline cases, the system is deciding in practice. The analyst approves what arrives and nobody reviews what was left out.

Two practices prevent it. First, at every session the committee reviews a sample of applications the system declined or flagged as doubtful, not only the ones it recommends approving. Second, track how often the committee overrides the system. If that rate stays at zero for months, the likely explanation is not a perfect system but that nobody is reviewing it. If it climbs, the system is miscalibrated or the policy changed and nobody updated it.

The file that builds itself

The evidence the CNBV or CONDUSEF asks for can be a by-product of the process, not a report someone writes afterwards. If every step records, at the moment it happens, what data it used, what rule it applied and who confirmed it, the file already exists when they ask for it, without depending on someone rebuilding it from memory.

That is the logic of continuous compliance monitoring, another use case on our financial services page: the system checks controls every day and stores the evidence with its date.

We measured the same principle at Human Staff. It is not a lender: it is the treasury of a staffing company, and we cite it because the evidence problem is the same. The system proposes a category for each transaction, the accountant confirms or corrects it, and every classification keeps its reason in writing. Measured against 1,043 real transactions as of August 20, 2026, the system was right 97.5% of the time. For the auditor, understanding a decision no longer depends on one person's memory.

The AML alerts that never fire

Continuous monitoring only sees what its thresholds let it see: a transaction that doesn't trigger an alert reaches no one. The AML risk is not only the alert reviewed late, but the one that was never generated and so was never reported to the UIF, through the CNBV, as article 95 Bis of the LGOAAC requires.

Thresholds are calibrated against your own history: run them on past transactions your compliance officer already reported as unusual or relevant, and check that the system would have flagged them. Mexico's AML rules for SOFOMs already require reviewing the risk assessment methodology when new risks appear or at least every 12 months. Review the thresholds on the same schedule, and whenever a new product, channel or segment comes in, with sign-off from whoever answers for compliance.

Why oversight is an advantage, not a brake

The SOFOM that records every step as it happens can adjust a credit rule or launch a product before its peers, because the evidence is ready when someone asks for it. Where it is assembled by hand, every change drags weeks of documentation and gets postponed. That is what puts a lender ahead of its market: being able to move without every move opening a new front with the regulator.

The condition is a written policy. A system cannot document a criterion that lives only in a credit director's experience. If that is your case, the first project is not AI: it is writing the criterion down.

What to do on Monday

1. Put three numbers on your 2027 planning sheet: days to answer an applicant, cost per loan placed and past-due loans by vintage. Those are the numbers an AI project has to move.
2. Mark the decisions a person approves today under your credit manual or under CNBV and CONDUSEF rules: the loan, the restructuring, the AML report. Those are not delegated.
3. Classify the remaining steps by consequence: reversible, costly to fix or no way back. The classification tells you what the system can execute.
4. Run the file test: ask for the file of a loan approved six months ago and ask why it was approved. If the answer takes days, evidence is being assembled by hand, and that is how it will reach the next review.
5. Ask when the AML alert thresholds were last reviewed and who approved them. If nobody knows, that is where the work starts.

Before your 2027 planning session

Our method starts from the supervised process you already have: which decisions your people approve today, what evidence your regulator asks for and which steps the system can prepare. From there we design what AI executes, phase by phase, without taking away anyone's decisions they have to answer for.

**See the Method →**

Go deeper:

• Use cases at lenders: Financial services
• What any board decides before approving: AI from the boardroom chair
• What it looks like in production: Case studies