What a Mexican lender reports to the credit bureau, and how it proves it every month

Mexico has three licensed credit bureaus: Trans Unión de México and Dun & Bradstreet, trading together as Buró de Crédito, and Círculo de Crédito. A SOFOM, the non-bank lender's legal form, must report every loan to at least one, with origination and first-default dates, and file the bureau's proof with CONDUSEF within 5 business days of each month.

Reporting every loan is a condition of being a SOFOM at all

The SOFOM, sociedad financiera de objeto múltiple, is the legal form most Mexican non-bank lenders use. Article 87-C Bis of the Ley General de Organizaciones y Actividades Auxiliares del Crédito says it «deberán ser Usuarios de al menos una sociedad de información crediticia, debiendo proporcionar periódicamente la información sobre todos los créditos que otorgue», and that compliance must appear in its registration with CONDUSEF, the financial consumer protection agency.

That registration is not paperwork on the side. Article 87-K of the same law says a company without it, or whose registration is cancelled, «no tendrán el carácter de sociedad financiera de objeto múltiple», and lists repeated failure to keep the bureau information current as a ground for cancellation. A SOFOM that stops reporting to the bureau is putting its legal form at risk, not only its borrowers' scores.

The bureau statute, the Ley para Regular las Sociedades de Información Crediticia (LRSIC), says what the report must carry. Article 20: users report «de manera completa y veraz» and state «la fecha de origen de los créditos que inscriban y la fecha del primer incumplimiento». A bureau may not register a loan without an origination date, or one more than 72 months past due. Article 20 Bis forbids reporting a loan the client never took, and article 26 lets a bureau refuse service to anyone who lends habitually and reports nothing.

The proof is a bureau document filed every month, and its date is public

CONDUSEF's Disposición en Materia de Registros, published in the Diario Oficial on 14 October 2022, turns the duty into a monthly filing. Within the first five business days of each month a SOFOM uploads to SIPRES, CONDUSEF's register of financial service providers, «el reporte de calidad de información o documento emitido por la Sociedad … de Información Crediticia … en el que se acredite que han cumplido con la obligación de reportar la información sobre todos los créditos otorgados» (articles 12 and 52).

The public SIPRES record of every SOFOM shows the result. Under «Datos de contrato con SIC» it names each bureau the lender contracts with, the term of the contract and an «Último cumplimiento» date: the last time the lender filed the bureau's document. Anyone can read it, with no account and no consent from the lender.

We read a random sample of the register on 14 October 2026, drawing registry numbers uniformly. Of 1,072 numbers, 554 led to a record, 364 of them unregulated SOFOMs (SOFOM E.N.R.) and 135 of those listed as operating. Six in ten of the 135 contract only with Círculo de Crédito, a third only with Buró de Crédito, and four with both. Nine in ten uploaded a bureau document in September or October 2026.

A bureau forgets small defaults within one to four years, by rule

Article 23 of the LRSIC obliges a bureau to keep a history for at least 72 months, and to delete an uninterrupted default 72 months after it was first recorded. Loans below 1,000 UDIS, the inflation-indexed unit, go sooner, on a schedule Banco de México sets in rule 12 of its Circular 27/2008: 12, 24 or 48 months depending on the balance, counted from the first default or from the lender's last update of the record, whichever came first. Two defaults are never deleted: one on 400,000 UDIS or more owed to a single creditor, and one tied to a final conviction for intentional fraud on the loan (article 24).

For a fund this matters in one direction. Read against the bureau, an old small-ticket vintage looks better than it was, because its defaults have aged out. The lender's own records keep them, which is why loss history is rebuilt from the tape, cohort by cohort, the way a static pool is built.

The CNBV checks the bureau data of regulated lenders, not of the unregulated SOFOM

The CNBV, the banking and securities regulator, supervises bureau users. At the end of 2024 it counted 401 of them, 37 of them SOFOMs, and it built an indicator that «permite detectar deficiencias en la información crediticia reportada» by those entities (Informe Anual 2024, section C.2.5.12). Its own footnote lists who they are: banks, development banks, credit unions, cooperatives, SOFIPOs, public trusts and the regulated SOFOM, SOFOM E.R.

The unregulated SOFOM E.N.R. is not on that list. Article 87-J of the LGOAAC makes it subject to the CNBV «únicamente para efectos de lo dispuesto por el artículo 56», the anti-money-laundering article. Banco de México counts 1,777 unregulated SOFOMs with a positive loan book at March 2026. For them, the regular check on the file sent to the bureau is the bureau's own document, which the lender files with CONDUSEF each month.

A fund cannot pull the bureau, so it reads what the lender files

Article 25 of the LRSIC limits bureau users to «las Entidades Financieras, las Empresas Comerciales y las Sofomes E.N.R.». A foreign fund that lends to a lender is none of the three. Consent runs to the lender too: article 28 requires the borrower's signed authorisation for every individual and for companies owing less than 400,000 UDIS, and lets a user that buys or administers the portfolio rely on the consent given to the originator.

So the diligence step is short. Read the lender's public SIPRES record for the bureau names and the last filing date. Ask for the bureau contracts and the twelve monthly documents the lender filed with CONDUSEF, and read them against the loan tape for the same months. A filing date older than the latest monthly deadline is a question to ask before any other.

Registry numbers in the SIPRES sample were drawn uniformly at random; each record was read once on 14 October 2026 from the public page. Our computation, offered as such.