Mexico: Real-Time Tax Data Access Obligation

Mexico’s tax authority (the SAT) has introduced a new requirement for foreign digital services providers and intermediaries operating in Mexico. Under Rule 2.9.21, you must give the SAT ongoing, online access to transaction data related to your Mexican customers, going into effect from 1 January 2026

This article explains what the rule requires, who it applies to, and exactly what you need to do—including answers to the questions we’ve heard most from clients.

Who does this apply to?

This rule applies to you if you are:

• A foreign digital services provider with customers in Mexico, or

• A foreign digital services intermediary facilitating transactions between sellers and Mexican customers

What does this require?

In plain terms: you need to maintain a database of transaction records and provide the SAT with login credentials to access it at any time.

The SAT can access your data at any time—not just at filing. Think of it as granting ongoing read access to your records, rather than submitting a one-off report.

What data do you need to store?

If you are a digital services provider

For each transaction with a Mexican customer, record:

1. Type of service or operation performed

2. Customer’s Mexican tax ID (RFC)—if a tax invoice was requested. If not, use the generic RFC: XAXX010101000

3. Price paid by the customer, excluding VAT

4. VAT charged

5. Final price paid by the customer, including VAT

6. Tax invoice folio number, or enough information to identify each receipt issued

7. Payment method used by the customer

If you are a digital services intermediary

For each seller or service provider on your platform, record:

1. Full name, corporate name, or legal denomination

2. RFC or foreign tax identification number

3. CURP (for individuals resident in Mexico)

4. Tax address, place of residence, or nationality

5. Financial institution and CLABE, or domestic/foreign bank account number

For each transaction processed through your platform, also record:

1. Transaction amount for income tax purposes

2. Transaction amount for VAT purposes

3. Transaction amount for IEPS purposes

4. Payment methods used by sellers, buyers, and the platform

5. Income tax withheld

6. VAT withheld

7. IEPS withheld

8. For lodging or accommodation services: full address of the property

9. For sale of goods: whether the transaction is an importation, and applicable customs duties

How must the data be stored and shared?

• Upload frequency: Data must be uploaded no later than the day following each transaction. If you registered before 30 April 2026, the obligation begins 1 May 2026. If you register after 30 April 2026, you have 15 days from the date your registration becomes active to comply.

• Storage format: Records must be stored transaction by transaction, in a database that supports both individual and bulk processing.

• Retention period: Data must remain accessible to the SAT for five years.

• Access credentials: You must provide the SAT with a username and password to access your system, along with any manuals or guides needed to use it.

What system can you use?

The SAT does not require a specific platform. Cloud-based solutions—such as Google Drive—are acceptable. What matters is that the information is complete, accessible, and easy to review.

There is no mandated file format—Excel, CSV, and JSON are all permitted. Choose something clean and easy to navigate. Once you’ve settled on a format, we’re happy to review it and confirm it meets all requirements before you submit.

Key dates

What you need to do next

• Confirm whether this rule applies to your business (digital services provider or intermediary with Mexican customers)

• Check your existing data against the required fields listed above—identify any gaps now

• Choose your database and file format (cloud-based solutions like Google Drive are fine)

• Send Taxually the link, username, and password to access your transaction database—our local partner in Mexico will take it from there

• Our local partner will prepare and file a formal writ with the relevant authorities, explaining how the SAT can access your platform to review your transaction data in real time

• Begin transaction-level daily uploads from 1 May 2026 (or within 15 days of your registration becoming active, if you register after 30 April 2026)

Common questions

Does this affect my VAT registration in Mexico?

No. This requirement is separate from the registration process and has no impact on it. The obligation kicks in once your registration is complete—at that point, you’ll need to have the database and access credentials ready to hand over.

What happens if we don’t comply?

The SAT has the authority to block digital services that fail to comply. While the specific penalties—such as financial fines, return filing restrictions, or licence revocation—are not yet fully detailed, you should treat this rule as enforceable from the outset.

As this is a new requirement, there may be some practical flexibility in early enforcement—but we would not recommend relying on that. Plan to be compliant from day one.

We don’t issue Mexican tax invoices—does this still apply to us?

Yes. There is no exemption or simplified treatment for businesses that don’t issue Mexican tax invoices (CFDI). The obligation applies to all foreign digital services providers operating in Mexico, regardless of invoicing practices.

If no tax invoice is requested, simply use the generic RFC (XAXX010101000) for all transaction records.

When does the data obligation actually begin?

The effective obligation to upload transactional data begins on 1 May 2026. The period from 1 January to 30 April 2026 is an implementation window to allow businesses to set up the necessary systems.

The 30 April filing deadline is when you must submit the formal notification to the SAT—it is not the start of ongoing data uploads.

Is daily uploading strictly required, or can we submit data in batches?

The law requires data to be uploaded no later than the day following each transaction. There is no official grace period for this requirement once the obligation begins on 1 May 2026.

If your existing data infrastructure covers all the required fields, you can work with what you have. If not, you’ll need to build or adapt your systems to capture and upload the missing data points.

We recognise this may be a significant technical project. If you’re working toward compliance and need guidance on what’s acceptable in the interim, contact your Taxually account manager.

Need help? Contact your Taxually account manager or reach out to our support team. We’re here to make this as straightforward as possible.

Disclaimer: This article is provided for general informational purposes only. It does not constitute tax, legal, or financial advice, and should not be relied upon as such. Tax laws and regulations are subject to change, and your specific circumstances may affect how they apply to your business. Taxually accepts no liability for any actions taken or not taken based on the information in this article. We strongly recommend that you seek independent advice from a qualified Mexico-based tax professional before making any decisions relating to your obligations under Rule 2.9.21.