The Silence That Costs More Than the Breach

Banxico reported 3 cyberattacks on the Mexican financial system in 2025. That same year, 3.82 million Mexicans filed fraud complaints — averaging 13,995 per day. Someone isn't counting the same thing. This article counts both — and what the gap between them is costing everyone in the room.

JM

Jorge Mercado · #JMCoachEnterprise Architect · Financial Risk · Digital Transformation · Fintech & Regulatory Strategy

10 min read
May 2026

The financial system's most expensive failure is rarely the attack. It's the institutional choice to manage it quietly — and absorb the cost in silence.

3

Cyber incidents officially reported by Banxico in 2025

Banxico Financial Stability Report · 2025

3.82M

Fraud complaints from users that same year — 13,995 per day

BEF / CONDUSEF · 9 months 2025

$16.7B

MXN in user-reported losses in 9 months of 2025

Buró de Entidades Financieras · 2025

$20.9B

USD in cybercrime losses reported by FBI IC3 in 2025 — a new record

FBI Internet Crime Complaint Center · 2025

$10.8T

Estimated real global cybercrime cost in 2026 — including unreported incidents

Cybersecurity Ventures · 2026

$250T

Authorized Push Payment fraud volumes projected by 2027

LSEG · Fintechmagazine.com · July 2025

The gap between what is reported and what is real

In Mexico, the regulatory protocol for a cyberattack on a financial institution goes something like this: the institution detects an incident, activates its internal Sensitive Information Security Incident Response Group (GRI), manages containment internally, and reports to Banxico and the CNBV. What gets reported publicly is what was confirmed, contained, and determined not to have "materially affected customers." What doesn't get reported is the attack that was managed quietly before it could be classified as a material event — and the thousands of user accounts that were compromised in the margins of that determination.

This is not a Mexican problem. It is an institutional incentive problem with a North American address. Banxico officially documented three cyberattacks on the financial system in 2025, with a declared total loss of 33.2 million pesos. In the same period, the Buró de Entidades Financieras registered 3.82 million fraud complaints from users — an average of 13,995 per day — with a combined financial impact of 16,678 million pesos. The math doesn't reconcile. One side of that equation is institutions reporting what they are required to report. The other side is users reporting what actually happened to them.

"Observed increases in ransomware are almost certainly higher since many incidents go unreported." — Canadian Centre for Cyber Security, National Cyber Threat Assessment 2025–2026. The same logic applies to every jurisdiction where institutions face reputational and legal risk from disclosure.

In the United States, the FBI's Internet Crime Complaint Center recorded $20.877 billion in cybercrime losses in 2025 — the first time the figure crossed $20 billion, representing 859,532 voluntary complaints. Cybersecurity Ventures estimates the actual global cybercrime damage at $10.8 trillion in 2026 when unreported incidents and indirect costs are included. The ratio between reported and estimated real losses is roughly 500 to 1. That is not a measurement gap. That is a structural silence.

In Canada, the Anti-Fraud Centre received nearly 100,000 fraud reports in 2024, representing $638 million in reported losses. In the same period, Canadian businesses spent over $1.2 billion just in recovery costs — nearly double what was formally reported as lost. 72% of Canadian small and medium-sized businesses experienced a cyberattack in 2024. Most never filed a formal complaint. Most never disclosed the breach. Most absorbed the cost and moved on — hoping the next quarter's numbers would be better.

Financial fraud is not a risk to manage. It is an industry to understand.

Organized cybercrime has its own product development cycles, its own talent pipelines, and its own ROI metrics. The institutions that underestimate this are paying for it in their claims data.

The infographic published by Fintechmagazine.com in July 2025 contains a number that most financial executives read and then move past: 156% year-on-year growth in fraud rates in the fintech sector in 2024. Not 56%. Not 16%. One hundred and fifty-six percent in twelve months. That is not fraud growing alongside digital adoption. That is a parallel industry that has professionalised faster than the defenses it is exploiting.

Global credit card fraud losses are projected to reach US$43 billion by 2026. Authorised Push Payment (APP) fraud — where victims are psychologically manipulated into transferring funds to criminal accounts — is projected to surge from $150 billion in 2017 to an estimated $250 trillion by 2027. The scale of APP fraud alone makes it not just a financial crime problem but a systemic economic risk that dwarfs the declared reserves of most national banking systems.

The Fraud Iceberg — What Gets Reported vs. What's Real

Mexico 2025 · Official vs. user-reported losses — same year, same system

Sources: Banxico Financial Stability Report 2025 · Buró de Entidades Financieras (BEF) / CONDUSEF · 9 months 2025

The financial mathematics of this silence are not neutral. When a bank absorbs a fraud loss without reporting it, three things happen simultaneously: the attack vector remains active for other institutions, the regulators cannot calibrate supervisory resources to actual risk, and the user who was defrauded receives an explanation — "chargeback under review" — that is technically accurate and practically useless. Mexican banks returned only 25% of the $10.7 billion pesos claimed by users in the first half of 2025. Identity theft alone generated $634 million in claims — and institutions reimbursed one-tenth of that amount.

Regulators are beginning to count — and the fines are escalating sharply

CNBV fines up 162% in 2024, then a further 41.5% in 2025 — historic records two years running

The CNBV's enforcement trajectory tells the structural story clearly. In 2023, fines were modest. In 2024, approximately 800 sanctions totalling 216.2 million pesos were imposed — a 162% increase over the prior year. In 2025, the figure jumped to 1,154.9 million pesos — a further 41.5% increase, the highest total in the commission's history. Nearly a third of those fines — 366 million pesos — were directly related to anti-money laundering control deficiencies.

Institution	Sanction — amount	Reason	Year
CIBanco + Intercam + Vector	$185.7M MXN (~$9.8M USD)	AML failures; facilitating cartel money laundering — flagged by US FinCEN	2025
Banorte	$13.9M MXN	Failure to provide information within regulatory deadline (Ley de Instituciones de Crédito)	Dec 2024
Banca Mifel	$64.5M MXN	AML failures, internal control deficiencies, risk diversification non-compliance	2025
BBVA México	6 sanctions (part of $6.7M MXN)	Regulatory reporting and compliance deficiencies	2024
Invex	$400,000+ MXN	No automated system for detecting unusual client transactions	Dec 2024
Banco del Bienestar	$767,580 MXN	Internal control deficiencies + failure to report in first two months of 2024	Dec 2024
Morgan Stanley (Mexico)	$896,200 MXN	No internal controls ensuring compliance with own internal regulations	Dec 2024
Santander México	$1.6M MXN + sanctions	Regulatory compliance deficiencies — among top 6 for user fraud complaints	2024

The CNBV has been explicit about what's driving the escalation: the U.S. Treasury's FinCEN designation of six Mexican drug cartels as terrorist organizations in early 2025 introduced new international compliance pressure that is being transmitted directly into Mexico's supervisory framework. "We are strengthening supervision to avoid any situation," said CNBV President Jesús de la Fuente. The translation for institutions is blunt: the supervisory tolerance of prior years is over.

CONDUSEF's enforcement lens operates in parallel — focused on user protection rather than prudential regulation. The six banks with the highest complaint volumes in the first nine months of 2025 were BanCoppel (1.07M complaints), Banco Azteca (503K), BBVA (409K), Banamex (396K), Banorte (371K), and Santander (250K). The concentration of complaints at digital-first and mass-market institutions reveals where the fraud vectors are densest — and where the technological defenses are most clearly insufficient relative to the client base being served.

The leverage risk: inflating the bubble while reporting it under control

The NPL ratio shows 2.02%. The adjusted IMORA including restructured loans shows 10.4%. Two metrics, one portfolio. The gap between them is where the risk is being parked.

The official Non-Performing Loan (NPL) ratio for Mexico's banking sector closed 2024 at 2.02% — a number that reads as stable and well-managed. The same portfolio, measured using the IMORA (adjusted index that includes restructured loans and those with elevated default probability) closed at 10.4% — five times higher. Both metrics are reported by the CNBV. One circulates in press releases. The other lives in the technical annexes.

The mechanism that produces this divergence is well-documented: write-offs and portfolio restructurings allow institutions to remove impaired loans from the NPL numerator while the economic exposure remains. In 2024, Mexico's banking sector processed write-offs and castigos (loan cancellations) at a real annual average growth rate of 27.3% — significantly exceeding the rate of new credit creation. The effect is a reported NPL ratio that looks controlled while the credit portfolio is being cleaned through the income statement at an accelerating pace.

⚠ Bubble Inflation Signals — Mexico's Consumer Credit Portfolio, 2024–2025

Consumer credit +13.7% in 2024Rapid growth creates a "denominator effect" that suppresses the NPL ratio even as the absolute volume of impaired loans grows. The ratio looks stable; the exposure doesn't.

Credit card NPL: +18.4% real in 2024After moderating from 38.4% growth in 2023 — still accelerating in absolute terms. Tarjetas de Débito and nómina portfolios "starting to show signs" of stress, per BBVA Research March 2025.

Write-offs +27.3% real growthInstitutions are cleaning the portfolio faster than credit is growing — a structural pattern that historically precedes reported NPL deterioration when write-off capacity is exhausted.

Financial leverage at the system level increasedBanxico's Financial Stability Report (June 2025) notes that aggregate system risk increased "driven by higher financial sector leverage and an increase in macroeconomic risks" — the heat map moved toward red.

Fraud losses not fully provisionedThe $10.7B pesos in user-reported fraud claims in H1 2025 represent unrecovered exposure. Of this, institutions reimbursed $2.5B — leaving $8.2B in unresolved claims with uncertain provisioning treatment.

IMORA adjusted = 10.4% — five times the headline NPLThe gap between the headline 2.02% and the adjusted 10.4% is where the true credit quality picture lives. Investors pricing sovereign and institutional risk on the headline metric are pricing the wrong number.

The parallels with pre-crisis dynamics in other markets are not allegorical. As one NPL specialist noted with reference to 2008: "Institutions were celebrating NPL ratios 'under control' while ignoring critical signals: geographic concentrations, accelerated migration between categories, or the real quality of restructurings." The difference between a managed credit cycle and a developing crisis is often not the data — it's the interpretation that institutions choose to present publicly versus what their internal risk committees are reading.

North America: three markets, one structural pattern

$17.4B

MXN — projected Mexico financial fraud losses in 2025

Inversor Latam · CONDUSEF · 2025

$6.08M

USD — average cost per breach in the financial sector globally, 2024

IBM Cost of a Data Breach 2024

$10.22M

USD — average US breach cost 2025 · record high · up 9% YoY

IBM Cost of a Data Breach 2025

27%

Of all global breaches targeted financial institutions in 2023 — more than healthcare

Verizon DBIR 2024

65%

Of Mexican businesses reported an increase in breaches in 2024

Embroker Cybersecurity Statistics 2025

72%

Of Canadian SMBs experienced a cyberattack in 2024

Embroker · Scotiabank Cybersecurity Report 2025

In the United States, the pattern of institutional silence carries specific regulatory consequences. The FDIC explicitly does not protect depositors against "losses due to theft or fraud" — meaning that cyber-enabled fraud losses are absorbed entirely by the institution or the customer, with no federal backstop. This creates a systemic incentive to minimize the reported scope of fraud events. Business Email Compromise (BEC) alone generated $3.046 billion in US losses in 2025 — the single most financially destructive enterprise-targeted cybercrime, and one that by definition involves institutional infrastructure being weaponized against the institution's own clients.

In Canada, the picture is defined by asymmetry of sophistication. The Canadian Anti-Fraud Centre received 100,000 fraud reports in 2024 with $638 million in declared losses — while Canadian businesses simultaneously spent over $1.2 billion in recovery costs. The gap between those two numbers is not rounding error. Investment scams represent nearly half of all dollar losses in Canada, with seniors over 60 accounting for more than a quarter of total reported losses despite lower reporting volumes. The sophistication of the attacks is rising: AI-generated deepfakes, hyper-personalized phishing, and synthetic identity fraud are documented by the Canadian Centre for Cyber Security as active and accelerating threats.

In Mexico, the telecommunications fraud vector adds a dimension absent from US and Canadian analysis: fraud in the telecom sector reached 4 billion pesos in 2024, largely attributable to account activations using false identities. The intersection of financial fraud and telecom fraud means that the attack surface extends from the banking app to the SIM card — and the regulatory perimeter of each sector ends at the boundary of the other. Criminal actors operate across both. Regulators operate within their respective jurisdictions. The gap is systematically exploited.

Doing things right is not a cost. It is the only viable strategy.

The institutions that built robust security and compliance architecture first are not slower. They are the ones that didn't spend Q3 in crisis mode explaining a breach to their regulator.

The infographic that opened this analysis contains two numbers that belong together: 86% of banks surveyed are investing in new technology to combat fraud, and adaptive technology can reduce phishing losses by up to 90%. Read separately, they are statistics. Read together, they describe the exact distance between where most institutions are and where they need to be — and the size of the return available to those that close it.

The Credit Union documented elsewhere in this series built a world-class financial platform in eleven months — passing a global penetration test with only three minor observations. It did so with a team that combined regulatory expertise, architectural discipline, and committed talent, on a budget that most mid-sized banks would classify as a rounding error in their technology spend. The result was not a compromise between speed and security. It was a demonstration that the two are not in tension — they are the same decision, made correctly from the beginning.

✓ What "Doing Things Right" Actually Looks Like — Operationally

Security is an architecture decision, not a compliance checkboxInstitutions that build Zero Trust frameworks, real-time transaction monitoring, and behavioral analytics into their core stack don't face a tradeoff between security and speed. They build once and scale cleanly.

Transparency with regulators is cheaper than managing finesCNBV fines reached $1,154M MXN in 2025. The technology to detect and report suspicious transactions in real time costs a fraction of that — and positions the institution as a regulatory partner rather than a regulatory target.

Fraud detection reduces NPL exposure — not just cybercrime riskSynthetic identity fraud, account takeover, and application fraud inflate the performing loan portfolio with credits that will never be repaid. Institutions with robust KYC and behavioral analytics see lower NPL because they never originate those loans.

Reporting honestly does not destroy confidence — it builds itThe institutions that disclosed breaches clearly, acted quickly, and communicated transparently with affected users maintained client relationships at higher rates than those that minimized. The silence is not protecting the institution — it is delaying the consequence.

AI works on both sides of the ledger86% of banks are investing in fraud-fighting technology. The same AI that detects anomalous transactions also optimizes credit origination, reduces operational cost, and generates the regulatory reporting that previously required full compliance teams. The investment has multiple returns.

The window to act is open — it won't stay open indefinitelyCNBV's enforcement trajectory is clear. FinCEN's reach into Mexican institutions is documented. The FBI's cross-border enforcement cooperation with Mexico and Canada is expanding. The cost of voluntary action today is a fraction of the cost of regulatory-compelled action tomorrow.

The processes are not complex when observed from the right perspective. The fraud problem, the NPL risk, the regulatory escalation — they are each a signal pointing at the same root cause: decisions deferred, controls under-resourced, and risk managed for the quarterly report rather than for the institutional balance sheet. The solution is not different technology. It is the decision to use it honestly.

Financial fraud will cost the North American economy more in 2026 than in any prior year. The question for every executive reading this is not whether their institution has experienced a significant incident. The actuarial probability says it has — or is in the process of discovering one. The question is what the institution chooses to do with that information.

Silence is a choice. Transparency is also a choice. The institutions that survive the next regulatory cycle with their licenses, their client relationships, and their reputations intact will be the ones that made the second choice — and made it before the regulator forced the first one.

Financial Fraud Cybersecurity CNBV CONDUSEF NPL Risk Mexico USA Canada Fintech Regulatory Risk #JMCoach @JormerMx

---

Verified Sources · May 2026

• Banxico · Financial Stability Report 2025 — 3 cyber incidents officially reported · $33.2M MXN declared · banxico.org.mx
• CONDUSEF / Buró de Entidades Financieras (BEF) · 3.82M fraud complaints in first 9 months of 2025 · 13,995/day · $16,678M MXN · buro.gob.mx
• CONDUSEF · H1 2025 fraud report · 2.4M cases · $10,714M MXN claimed · $2,556M reimbursed · condusef.gob.mx
• CONDUSEF · Identity theft H1 2025 · $634M MXN claimed · only $65M reimbursed · +24.6% YoY · vanguardia.com.mx
• CNBV · ~800 sanctions in 2024 · $216.2M MXN · +162% vs 2023 · expansion.mx · March 2025
• Cadena Política · CNBV 2025 historic fines · $1,154.9M MXN · +41.5% vs 2024 · cadenapolitica.com · February 2026
• La Jornada · CIBanco + Intercam + Vector · $185.7M MXN sanctions · FinCEN AML designation · July 2025
• Revista Fortuna · CNBV December 2024 · 262 sanctions · $103.6M MXN · Banorte, Santander, Mifel, Morgan Stanley, Bienestar · January 2025
• BBVA Research · Situación Banca México · March 2025 · IMOR 2.02% · IMORA 10.4% · castigos +27.3% real · NPL tarjetas +18.4%
• Banxico · Financial Stability Report June 2025 · aggregate risk increased · higher financial leverage · macroeconomic risk up
• Mexico Business News · IMOR 2.02% December 2024 · consumer credit +13.7% · February 2025
• FBI Internet Crime Complaint Center (IC3) · 2025 Annual Report · $20.877B in losses · record high · BEC $3.046B · Seniors $7.7B
• Axis Intelligence · Cybersecurity Statistics 2026 · IC3 $16.6B (2024) · US breach cost $10.22M (+9%) · ibm.com/security · April 2026
• Cybersecurity Ventures · Global cybercrime $10.8T 2026 (estimated, includes unreported)
• Canadian Centre for Cyber Security · National Cyber Threat Assessment 2025–2026 · underreporting confirmed · $1.13M avg ransom Canada 2023
• CAFC / Scotiabank · 100,000 fraud reports Canada 2024 · $638M reported losses · $1.2B recovery costs 2023 · scotiabank.com
• Embroker Cybersecurity Statistics 2025 · 72% Canadian SMBs attacked · 65% Mexican businesses reported breach increase
• IBM Cost of a Data Breach Report 2024 · $6.08M avg financial sector breach (22% above cross-industry avg) · ibm.com
• Verizon Data Breach Investigations Report 2025 · Financial sector 27% of all global breaches · phishing 16% of initial vectors
• Inversor Latam · Mexico fraud losses 2024: $14,500M MXN · 2025 projection: $17,400M MXN · February 2025
• Fintechmagazine.com · July 2025 · Cybersecurity infographic · 156% YoY fintech fraud · $43B credit card fraud by 2026 · $250T APP by 2027
• Fortinet · Global Threat Landscape Report 2025 · +42% credentials shared on dark web forums
• Consumer Federation of America · The Scam Economy Report · March 2026 · FBI IC3 + FTC underreporting analysis

JM

Jorge Mercado · #JMCoach

Enterprise Architect · Financial Risk · Digital Transformation · Fintech · Regulatory Strategy 

The Numbers That Rewrote Commerce

Mobile was 10%. Social was a side channel. The "store" was the main event. In 2026, every one of those assumptions is gone — replaced by a $6.88 trillion ecosystem where your phone is the store, the feed is the checkout, and AI is the salesperson who knows you better than you know yourself.

In 2026, 59% of all global e-commerce transactions happen on a screen that fits in your pocket. The channel shift is not coming — it already happened.

When I first wrote about consumer and commerce trends, mobile and social media were each at roughly 10% of total channel activity. They were trends worth watching — but the "store," the web browser, and the physical point of sale still ruled. I said: these two channels are the ones with all the growth ahead of them. That prediction was an understatement.

In 2026, mobile alone drives 59% of global e-commerce revenue — more than $4 trillion in a single year. Social commerce has grown from a novelty to a $2.6 trillion market. The physical store is no longer the center of gravity for commerce. The algorithm is. The feed is. The live stream is. And increasingly — the AI agent that buys for you before you even thought to search.

Here is what the landscape looks like now, with every number sourced and verified.

The channel flip nobody fully expected

78% of all e-commerce site traffic comes from mobile. The desktop never left, but it is no longer the default.

The channel mix in commerce has been inverted. Physical point-of-sale, which once anchored everything, now competes with a mobile-first ecosystem where 78% of all e-commerce traffic and 59% of all transactions happen on smartphones. The browser gave way to the app. The app gave way to the feed. And the feed is now giving way to the agent.

In the United States alone, mobile commerce reached $564 billion in 2024 — a 14.8% year-over-year increase. Globally, m-commerce revenue hit $2.5 trillion in 2025 and is projected to represent 63% of all retail e-commerce by 2029. This is not a niche behavior. It is the baseline.

Channel Share of Commerce Activity

Sources: eMarketer · Statista · DemandSage · craftberry · Charle · 2026 | Physical POS estimated as share of total retail; channels overlap in multi-touchpoint journeys

Social commerce: from scroll to sold in one tap

The most dramatic rewrite happened in social media. What was once a marketing channel — a place to build brand awareness and hope people would go elsewhere to buy — is now a $2.6 trillion commerce platform in its own right. TikTok Shop, Instagram Checkout, Facebook Shops, Pinterest Buy, YouTube Shopping. The content IS the store. The creator IS the sales team. The comment section IS the reviews page.

$2.6T

Global social commerce market in 2026 — growing at 26.2% CAGR toward $8.5 trillion by 2030. In 2015, this number was effectively zero as a standalone revenue category.

SellersCommerce · eMarketer · Statista 2026

82% of consumers now use social media for product discovery. 58% of U.S. shoppers have purchased a product directly after seeing it on social media. 43% of Gen Z starts their product search on TikTok — not Google. The search engine for commerce has changed. For an entire generation, the algorithm is the store window.

Live commerce accelerated this shift beyond anything 2015 models predicted. The global live commerce market reached $128 billion in 2024 and is now projected to hit $2.47 trillion by 2033 — a 39.9% CAGR that makes it one of the fastest-growing commerce formats in history. Conversion rates in live commerce run up to 10 times higher than traditional e-commerce. The reason is ancient: people buy from people they trust, in real time.

Marketplaces: the new infrastructure of commerce

Marketplaces now account for an estimated 67% of all global e-commerce transactions — not as a single platform but as a category that has become the default commerce infrastructure.

The marketplace model — where a platform connects buyers and sellers without necessarily owning the inventory — has become the dominant commercial infrastructure of 2026. 67% of all global e-commerce is estimated to flow through marketplace platforms. The question for any brand is no longer "should we sell on a marketplace" — it's "which marketplace, in which geography, with what strategy."

The geography of marketplace dominance is decisive: Amazon in the West, Alibaba in China, Shopee in Southeast Asia, MercadoLibre in Latin America, Jumia in Africa, Flipkart in India. No single global platform wins everywhere. Brands operating across borders must have a multi-marketplace strategy — or leave revenue to regional competitors who understand local consumer behavior, local payment infrastructure, and local trust dynamics.

Mexico alone shows what this looks like in practice: MercadoLibre holds 15.4% market share, Amazon 11.2%, with mobile devices driving 78% of all e-commerce transactions in the country. OXXO Pay — cash payments for online orders at convenience stores — remains uniquely important in a market where bank account penetration is still incomplete. Commerce infrastructure is local. The platform layer is global. The winning strategy navigates both.

Super apps: the operating system of daily life

The most consequential shift in commerce is not a new payment method or a new channel. It is the collapse of the distinction between messaging, commerce, payments, transport, food, healthcare, and entertainment into a single interface that people never leave.

The super app — one application that contains entire digital lives — was born in Asia and is now the fastest-growing model in the global digital economy. The global super app market was valued at $127 billion in 2025, projected to reach $838 billion by 2033 at a 27.25% CAGR. 3.5 billion people are expected to regularly engage with super app ecosystems by end of 2025.

Super Apps: Reach & Category

The super app logic is ruthlessly efficient: every service added cross-leverages behavioral data. A ride-hailing app that also sees your grocery orders, restaurant preferences, and payment history can build a personalization engine no single-service app can match. Retention compounds. Switching costs become impossible. The platform becomes invisible infrastructure — like electricity.

Asia-Pacific holds 53% of global super app revenue today, but the model is spreading fast. Africa is growing at a 30.34% CAGR, led by M-Pesa's evolution from mobile money to full commerce platform. In Latin America, Rappi and MercadoPago are the most advanced examples of the pattern — a single app touching payments, food, pharmacy, entertainment, and financial services for tens of millions of users who will never install a separate app for any of those services.

The channels that didn't exist in 2015 as revenue categories

Augmented reality turned product discovery into spatial experience. Nearly 60% of the U.S. population is expected to be frequent AR users by 2025, with 90% of American shoppers already using or open to using AR for shopping decisions. The return rate reduction alone — 40% lower for products with AR content — makes this a supply chain story as much as a commerce one.

Voice commerce matured into a $40 billion category in the U.S. and U.K. alone, driven by the normalization of smart speakers and voice-enabled payment confirmation. The interface that requires no interface — just natural speech — turns any moment in a day into a potential purchase trigger.

BNPL (Buy Now Pay Later) captured 12% of global e-commerce transaction value — a category that essentially did not exist as a consumer product in 2015. Klarna, Affirm, and Afterpay rewired consumer expectations around payment timing, turning what was once a fringe fintech product into a standard checkout option used by hundreds of millions of shoppers globally. Digital wallets now represent 54% of all global e-commerce transactions — cash and cards are the minority channel.

And above all of this sits the most consequential shift of the current cycle: AI-powered personalization as commerce infrastructure. 88% of consumers now expect personalized experiences — a 66% jump in two years. AI product recommendations drive up to 31% of e-commerce revenue for platforms that implement them. The average order value increase from AI recommendations is 15–25%. The AI is not a feature anymore. It is the store's best employee, and it never sleeps.

What all of this has in common — and what never changes

Every channel, every platform, every technology — what drives the transaction is always the same: trust, simplicity, and the feeling that the person on the other side of the screen understands you.

Across every data point, every platform, and every geography, one pattern holds without exception: the technology that wins is the one that reduces friction for the human using it. Mobile won because it removed the desk. Social commerce won because it removed the separate search step. Super apps won because they removed the separate app. AR is winning because it removes the uncertainty of online purchase. Voice is winning because it removes the screen.

The businesses that will define the next decade of commerce are not the ones that add the most features. They are the ones that remove the most steps between desire and fulfillment — while maintaining the trust, security, and feeling of being understood that makes people come back.

In 2015, I observed that people seek content, simplicity, security and opportunity in service. The entire $6.88 trillion digital commerce ecosystem of 2026 is an elaborate, technology-powered attempt to deliver exactly that. The answer has not changed. Only the speed, the scale, and the intelligence of the delivery have.

The channel is no longer the strategy. The experience is the strategy. And the experience that wins is the one where the consumer never has to think about the technology — only about what they want.

The question for every executive, entrepreneur, and analyst reading this is not "which channel should we be on." It's "how does every channel we touch feel frictionless, personal, and trustworthy to the person on the other end." Answer that, and the technology will follow.

The processes are not complex if you observe them from the right perspective — they are challenges that exist to create solutions.

Commerce 2026 Mobile Social Commerce Marketplaces Super Apps AI AR Fintech LATAM #JMCoach @JormerMx

---

Verified sources · May 2026

• DemandSage · Shopify 2026 — Global e-commerce $6.88T in 2026 · 7.2% YoY growth · 21.5% of total retail
• Craftberry Global E-commerce Forecast 2025 — $6.86T by end 2025 · 8.3% YoY · 20%+ of retail
• Dataopedia · Red Stag Fulfillment 2026 — Mobile 57–59% of global e-commerce · $2.5T m-commerce 2025
• Charle UK Ecommerce Statistics 2026 — Mobile commerce $4.01T in 2026 · 60% of online sales
• Statista 2025 — Mobile commerce revenue → 63% of retail e-commerce by 2029
• SellersCommerce 2026 — Global social commerce $2.6T · U.S. $126.6B · CAGR 26.2% → $8.5T by 2030
• Amra & Elma Social Commerce Statistics 2026 — Social commerce 22.4% of global e-com transactions
• The Retail Exec 2026 — Live commerce $128B (2024) → $2.47T by 2033 · CAGR 39.9% · 10x conversion
• The Retail Exec 2026 — Voice commerce $151.39B (2025) · AR: 94% higher conversion · 40% return reduction
• Cross-Border Commerce Europe 2026 — AI personalization: +15–25% conversion · 5–8x marketing ROI
• SQ Magazine Online Marketplace Statistics 2026 — Digital wallets 54% of global e-com value · BNPL 12%
• Analyzify / Netguru 2026 — Amazon 37.6% U.S. share · MercadoLibre 74% Mexico · 155M active buyers
• Channel Engine 2026 — Top 20 global marketplaces · Marketplace-driven global sales $6.3T
• Mordor Intelligence 2026 — Super apps market $127B (2025) → $968B by 2033 · CAGR 30.1%
• Straits Research 2025 — Super apps 3.5B users by 2025 · Asia-Pacific 53% global share
• Nimble App Genie 2026 — WeChat 1B+ MAU · Grab $15B platform · Super app architecture analysis
• Grand View Research 2025 — Super apps $838B by 2033 · CAGR 27.25%
• Salesforce Research 2026 — 88% consumers expect personalized experiences (+66% in 2 years)
• Fortune Business Insights 2026 — AI in e-commerce market $8.65B → $22.6B by 2032
• Netguru 2026 — Mexico e-commerce $97B (2024) · Mobile 78% of transactions · MercadoLibre 15.4% share

Jorge Mercado · #JMCoach

Most fintechs are not financial companies. They're user acquisition machines.

 The global fintech industry generates $378 billion in revenue. Only 100 companies account for 60% of it. Of 650 challenger banks globally, 92 are profitable. And the "later" when growth converts into a sustainable business — that's exactly where most of them fail. Here's what the data says, and what the path out looks like.

Jorge Mercado · #JMCoach 

I've sat in the room when the Series B deck goes up on the screen. The slide titled "Path to Profitability" is always there, always slide 18, always a hockey stick starting somewhere around year four. The investors nod. The founders believe it. And then the capital goes to customer acquisition, to marketing, to headcount that scales the funnel — not the margin. I've seen this in fintech, in insurtech, in payments platforms, in neobanks. The model is elegant on paper: acquire users cheaply at scale, convert them to revenue-generating products later, build defensibility through data and switching costs. The problem is that "later" requires a different kind of organization than the one built to execute "acquire cheaply at scale." And most fintechs never make that transition. Not because they're bad companies. Because they never designed for it.

$378Bglobal fintech revenues in 2024 — 21% growth year over year, up from 13% in 2023BCG / QED Investors 2025

3%of global banking and insurance revenue pools currently held by fintechs — in a $13 trillion marketBCG / QED Investors 2025

92 of 650global challenger banks are profitable as of Q1 2025 — only 24 generate over $500M in annual revenueQED Investors · BCG 2025

$1.5Tprojected fintech market size by 2030 — roughly 5x current revenues, if the right business models are builtBCG · QED Investors · WEF 2025

69%of publicly listed fintechs were profitable in 2024 — up from less than half in the previous yearBCG / QED / FT Partners 2025

The fintech companies that have crossed from growth machines to profitable institutions share one thing in common: they built the operational infrastructure before they needed it, not after the unit economics stopped working. The ones still burning capital in year six are paying the price of having optimized the funnel while leaving the foundation unbuilt.

The uncomfortable math of fintech economics

The headline numbers are seductive. Global fintech revenues grew 21% in 2024, outpacing incumbent financial services players by a factor of more than three. The AI in fintech market will grow from $30 billion in 2025 to $83.1 billion by 2030. There are 242 fintech unicorns globally valued at $950 billion. Revolut reached a $75 billion valuation. Stripe is valued at $91.5 billion. The sector has more privately held unicorns than any other industry — 16% of the total.

Now read the other numbers. Fewer than 100 of the approximately 37,000 fintech companies globally account for roughly 60% of industry revenue. Of 650 global challenger banks, only 92 are profitable — and of those, only 24 generate revenues above $500 million annually. Fintechs hold just 3% of the global banking and insurance revenue pool. BCG and QED Investors concluded in their 2025 report that the sector is reaching "a moment of reckoning" where investors are demanding maturity, and the path forward requires what they called "greater maturity in relatively pedestrian domains such as risk management and pricing."

Pedestrian. That word is doing a lot of work. Risk management. Pricing. Compliance architecture. Data governance. Fraud detection. These are not exciting topics for a Series A pitch. They are the difference between a fintech that burns through its runway and a fintech that builds a business.

"Most fintechs today are not really 'financial' companies — they are user acquisition machines financed by capital, trying to become profitable financial institutions afterward. That 'afterward' is where most of them fail, especially when they are just burning money."— Jorge Mercado · #JMCoach · CNBV-regulated fintech executive

Mexico: the second-largest fintech market in Latin America — with all the same problems at local scale

Mexico is a case study in fintech's dual nature: enormous potential, real progress, and structural challenges that the growth metrics often obscure. There are now over 1,000 fintechs operating in Mexico — 803 local companies and 301 foreign players, including NuBank and Revolut — making it the second-largest fintech market in Latin America after Brazil. Revenue for local fintechs grew 31% in 2024, reflecting a shift toward profitability and operational efficiency. The payments and remittances segment alone is projected to grow 76% by 2027.

The opportunity is real. Fewer than 70% of Mexican adults have a bank account. 85.2% of adults still use cash as their primary payment method for purchases under 500 pesos. Mexico handles over $66 billion annually in remittances — Bitso alone processed $6.5 billion in stablecoin remittances in 2024. Digital account ownership rose 15 percentage points over five years, and digital payments grew from 29% to 46% of adults. The market is moving.

But the regulatory and operational reality is harder. Only 84 fintech companies are fully regulated by the CNBV as of 2025, under Mexico's Fintech Law enacted in 2018. In December 2024, the CNBV revoked the license of a SOFIPO for 15 months of non-compliance with capitalization requirements. Three Mexican financial institutions were sanctioned by the U.S. Treasury in June 2025 for facilitating money laundering. The regulatory sandbox has received no authorized entities as of 2025 — reflecting ongoing regulatory caution about models that aren't operationally ready for the framework they're asking to operate in.

The gap between "operating a fintech app" and "operating a regulated financial institution" is not a compliance checkbox. It is a full redesign of how the organization makes decisions, manages risk, controls data, and aligns its technology with the business it is legally permitted to do.

1,004fintech providers operating in Mexico in 2024 — 803 local, 301 foreign, second only to Brazil in LATAMFinnovista Fintech Radar Mexico 2024

+31%revenue growth for local Mexican fintechs in 2024 — reflecting a shift toward profitability and operational efficiencyFinnovista · Chambers 2025

84fintechs fully regulated by the CNBV out of 1,000+ operating — the compliance gap is structuralCNBV · Mexico Business News 2025

$865Mventure capital invested in Mexican fintech in 2024 — 74% of all VC deployed in Mexico that yearFinnovista 2025 · Galileo FT

Mexico has 85 million smartphone users and 97 million people with internet access — yet 85% of purchases under 500 pesos are still made in cash. The infrastructure for change exists. The operational models to close that gap profitably are the missing piece for most fintechs attempting to serve it.

Where the money goes and why it doesn't come back

I want to be specific about where fintech economics break down, because it's not one problem. It's a cluster of related problems that reinforce each other when the organization doesn't have a coherent operating architecture connecting them.

The customer acquisition cost trap

The problem that doesn't show up in the deck

Fintechs compete for customers against incumbents with free checking accounts, established trust, and 40 years of brand equity. To win, they subsidize the customer relationship: better rates, no fees, cashback, referral bonuses. The unit economics at acquisition are frequently negative. The model assumes the customer will generate revenue later through product expansion — credit, insurance, investments, business banking. The problem is that the product expansion requires a completely different operational and regulatory infrastructure than the one that won the customer. Most fintechs build the acquisition engine first and then discover that the expansion engine requires a rebuild they weren't prepared for.

AI that was sold as a shortcut and became a liability

The real cost of poorly implemented AI in fintech

The promise of AI in fintech is legitimate: automated credit scoring, fraud detection at scale, personalized product recommendations, regulatory reporting, customer service. The WEF surveyed 240 fintech firms in 2025 and found that among those using AI effectively, 74% reported higher profitability and 75% reported reduced costs. That's a real result. But the same data shows what happens when AI is implemented without the supporting architecture: shadow AI (employees using unauthorized AI tools) added an average of $670,000 to breach costs per incident. Fintechs that deployed AI models on top of fragmented data without governance frameworks found themselves with models that produced biased credit decisions, compliant-looking fraud alerts that missed actual fraud, and customer service bots that created regulatory exposure by giving wrong financial advice at scale. AI doesn't fix a broken process. It scales it.

The silo problem that everyone sees and no one solves

How operational silos destroy fintech unit economics

In a typical mid-sized fintech, the team that built the onboarding flow doesn't talk to the team that runs compliance. The team that runs compliance doesn't share data with the team that runs risk. The team that runs risk built its models on data that the data engineering team has since changed the schema for — and nobody updated the models. Each team is optimizing their own metrics. The result is a company where the customer experience is designed by marketing, the risk model is designed by analysts, the compliance process is designed by lawyers, and the technology is designed by engineers — and none of the four are working from the same version of what the business is actually trying to do. That fragmentation doesn't show up in the monthly active user count. It shows up in the loan default rate, in the compliance finding, in the customer churn 90 days after activation when the product doesn't deliver on what the acquisition promised.

The fintech that has a single source of truth — where the customer data, the risk model, the product logic and the compliance framework are connected to the same reality — operates with a structural advantage that cannot be replicated by adding more engineers or more funding. It is an architecture decision, not a hiring decision.

What actually works — and why it's simpler than the consultants make it sound

Here is what I have observed across fintech operations in regulated environments — CNBV-supervised institutions, PCI-DSS-compliant platforms, KYC-intensive onboarding flows, and AI in production for credit, fraud, and customer service. The organizations that work are not the most sophisticated. They are the most coherent. Their processes are simple, well-defined and actually followed. Their systems reflect those processes. Their data is governed by someone who understands what it means for the business. And their AI is an accelerator of that coherence — not a substitute for it.

The path from acquisition machine to financial institution

What the 24 profitable challenger banks with $500M+ revenue did differently

BCG and QED documented in their 2025 fintech report that the 24 scaled challenger banks generating over $500 million in annual revenue were growing deposits at 37% annually — 30 percentage points faster than traditional banks. What they did differently isn't mysterious. They stopped measuring success in monthly active users and started measuring it in revenue per active customer, net interest margin, loss rates, and regulatory capital efficiency. Those metrics require a different operating model. They require credit risk teams that talk to product teams. They require compliance architectures that are built into the customer journey, not bolted on. They require data that is clean enough to be used in regulatory reporting and rich enough to improve model performance simultaneously.

The WEF survey of 240 fintechs found that 83% using AI effectively reported improved customer experience and 74% reported higher profitability. The key word is "effectively" — which in every case meant AI deployed on top of coherent processes and clean data, not as a layer on top of chaos.

The process-first principle that nobody wants to hear

Why simplicity is the actual competitive advantage

Every fintech founder I've met believes their product is complex. Some of them are right. But almost none of them have a simple, clear map of how their business actually works: how a customer moves from discovery to activation to revenue-generating product usage, what happens at each step, who owns each decision, what data is collected and how it flows, and where risk is created and managed. That map — call it process architecture, call it business architecture, call it whatever you want — is the thing that allows AI to add value instead of creating liability. A well-designed credit model running on consistent, governed data catches fraud and prices risk accurately. The same model running on 14 different data schemas across 6 legacy tables with inconsistent definitions catches some fraud, misprices some risk, and generates enough regulatory exposure to offset the cost savings three times over.

Fintech lenders now manage over $500 billion in loans globally. The ones with the lowest loss rates are not the ones with the most sophisticated models. They're the ones where the model knows exactly what data it's working with and the business knows exactly what the model is doing.

The fintech that thrives at scale is not the one with the best engineers or the most ambitious AI roadmap. It's the one where the CEO can explain how the business makes money, the CTO can explain how the systems support that, and the CCO can explain how compliance is embedded in both. When those three stories align, the organization executes. When they don't, the capital fills the gap temporarily.

The AI opportunity — for those who are ready for it

The AI opportunity in fintech is genuine and large. The AI in fintech market is valued at $30 billion in 2025 and is projected to reach $83.1 billion by 2030. Generative AI in banking and finance is projected to grow from $1.29 billion in 2024 to $21.57 billion by 2034. Those numbers represent real value creation — in fraud detection, credit underwriting, regulatory compliance automation, customer service, and risk monitoring.

But the WEF is precise about the precondition: 74% of fintechs that reported higher profitability from AI had adopted it as part of a coherent operational strategy — not as a standalone product initiative. The fintechs that installed AI on top of fragmented data and undefined processes got the opposite result: higher operational costs from model maintenance, regulatory findings from AI-driven decisions that couldn't be explained to auditors, and customer complaints from personalization systems that made recommendations based on incorrect data.

The right sequence is not: build product, acquire users, add AI, figure out operations. The right sequence is: define the business model, design the processes that support it, build the data architecture those processes require, and then deploy AI to accelerate the parts of that architecture that benefit from it. That sequence is less exciting to pitch. It produces dramatically better outcomes at scale.

The four questions every fintech board should be able to answer

What is our unit economics at 36 months of customer tenure? Not the blended average across all cohorts — the specific number for customers acquired in the last 12 months, at current CAC, with current product penetration. If the answer requires more than 30 seconds to retrieve, the data architecture is not serving the business.

Where exactly does revenue leak between product promise and revenue realization? Every fintech has a gap between the value the product promises and the revenue the customer generates. Mapping that gap precisely is not a marketing exercise — it is the foundation of every improvement initiative worth funding.

How much of our AI model performance can we explain to a regulator? Not in general terms — in specific terms, for the last 90 days, for the specific population segment the regulator is asking about. If the answer is "we'd need to check with the data team," the compliance architecture is not integrated with the operational reality.

If the two engineers who built the core of our platform left tomorrow, what would break and why? This is the knowledge architecture question. In most fintechs, the answer is "more than we'd like to admit." The technical debt in the knowledge layer is almost always larger than the technical debt in the code.

The fintech market is not over. The $1.5 trillion opportunity by 2030 is real. The 3% penetration of a $13 trillion banking and insurance market means there is more room to grow than there is market already captured. But capturing it profitably requires something the first era of fintech consistently underinvested in: the operational and architectural coherence that turns a user acquisition machine into a financial institution.

The companies that figure that out — not the ones with the best product or the most capital, but the ones with the clearest view of how their business actually works and the discipline to build systems that reflect that — are the ones that will still be here at the end of the decade. The ones that don't will have contributed impressive user growth metrics to the industry's story and burned through their investors' capital doing it.

That "afterward" doesn't have to be a mystery. It just has to be designed.

Sources: BCG / QED Investors "Fintech's Next Chapter" 2025 · WEF "Future of Global Fintech: From Rapid Expansion to Sustainable Growth" 2025 (Cambridge Centre for Alternative Finance, Cambridge Judge Business School) · FT Partners FinTech Strategic Insights 2025 · Finnovista Fintech Radar Mexico 2024 / 2025 · CNBV · Mexico Business News 2025 · Chambers & Partners Fintech 2025 Mexico · Galileo Financial Technologies 2025 · Miranda Intelligence 2025 · IBM Cost of a Data Breach Report 2025 · Statista / Mordor Intelligence · QED Investors blog "Fintech's Next Chapter" Q1 2025 · The Digital Banker / ABA Banking Journal June 2025.

Jorge Mercado · #JMCoach
Certified Professional Coach · CTO · Enterprise Architecture · C-Level
CNBV-regulated fintech · PCI-DSS · KYC · Face-ID · AWS Bedrock + Anthropic + MCP in production
SOFOM/SOFIPO migration · Data Lake · AI in production · Regulated sectors across Mexico and LATAM

twitter.com/JormerMx  ·  linkedin.com/in/mxjormer  ·  jmcoach-mx.blogspot.com