Choosing a credit bureau in Mexico
Mexico’s bureau market has two brands and three licensed companies, as Buró de Crédito is divided between individual and business companies and Círculo de Crédito operates alongside them. The LRSIC makes each bureau’s report carry the other bureau’s data unless separate reports are requested, and defaults and fraud records pass between the bureaus monthly. A SOFOM must contract with a bureau and report every loan to it, so the decision for you is which report and contracting company suit the book you are building.
Match the SIC to each borrower
If you are a SOFOM, the legal minimum is a contract with at least one Sociedad de Información Crediticia (SIC), Mexico’s term for a credit bureau. The law intends a single report to include data from the other SICs, but confirm what each contract actually delivers.
It is easy to treat Buró de Crédito and Círculo de Crédito as two providers holding separate parts of the market, then compare their prices or assume you need both. But Buró de Crédito comprises two SICs: one for individuals and another for companies and individuals with business activity. Círculo covers both. Match the SIC to the borrower you assess.
Credit bureaus in Mexico are the three companies behind those two brands. For a consumer loan, compare the consumer SIC under Buró de Crédito with Círculo. For a company or an individual with business activity, compare the business SIC with Círculo.
| Bureau | Company (SIC) | Borrowers | 2026 ownership |
|---|---|---|---|
| Buró de Crédito, consumer | Trans Unión de México, S.A., SIC | Individuals | TransUnion reported at 94% after five banks sold (Jul 2026) |
| Buró de Crédito, business | Dun & Bradstreet, S.A., SIC | Companies and individuals with business activity | Talks for the banks' stake reported, unconfirmed |
| Círculo de Crédito | Círculo de Crédito, SIC | Individuals and companies | Equifax agreement of 7 Jul 2026, closing expected Q4 2026 |
That identifies the SICs to compare. Confirm what each contract will deliver.
Confirm report contents and tariffs
The law describes a report that includes information from other SICs. Under article 36 Bis of the LRSIC, Mexico’s credit information law, you may instead request reports separately. If you choose separate reports, you must request the other SICs’ reports too.
Confirm each contract’s actual report contents with the bureau. Ask each bureau whether the contract supplies a report that includes other SICs’ data or a report with its own data only, and what authorised tariff applies. Ask which other SICs’ information its report includes.
Defaults and fraud records are exchanged through the Base Primaria de Datos. A SIC must send monthly captures of that database to another SIC that requests them, within 15 calendar days after the month ends. The Base Primaria exchange explains how some information moves between SICs. Check the report product and tariff before you buy.
Compare prices only after you know which reports the prices cover.
Apply Mexican credit bureau duties
The report and tariff determine what you buy. The law also determines what your process must do when it queries, declines and reports a loan.
Before a pull, obtain the applicant’s express authorisation with a handwritten or electronic signature. It must cover the information’s nature and scope, its use, and periodic queries during the legal relationship. This requirement applies to individuals and to companies with total credits below 400,000 UDIS. If the authorisation is part of the application paperwork, give it a separate section and an additional signature. Record when it was signed, what it covers and how long it remains valid.
| Step | The duty | Where |
|---|---|---|
| Before the pull | The applicant's signed authorisation, handwritten or electronic on Banxico's terms, valid one year and while the relationship lasts | Art. 28 |
| The report | Includes the other SICs' data unless you ask for separate reports, then you request each one | Art. 36 Bis |
| A decline driven by the report | Tell the applicant and give them the details of the SIC that issued it | Art. 39 |
| After you lend | If you are a SOFOM, report every loan to at least one SIC | LGOAAC art. 87-C Bis |
| Records | Kept at least 72 months, an unbroken default deleted 72 months after it was first recorded | Art. 23 |
SOFOMs must have a contract with at least one SIC for CONDUSEF registration and report every loan they grant to at least one SIC. Keep the contract current. CONDUSEF requires a new or renewed contract to be uploaded within 10 business days after the old one expires, and failure to prove that you use at least one SIC can trigger cancellation of the registration.
When a credit decline is mainly due to the report, tell the applicant and provide the details of the SIC that issued it. When you report past-due information that qualifies for the Base Primaria de Datos, notify the customer by email or phone if you have those details. These duties apply whichever SIC you choose.
Measure the value of a second report
Once you have the report terms and tariffs, decide on a second SIC by measuring what it changes in your book. A second report adds a cost. It is worth paying for only if the information changes lending decisions enough to justify that cost.
Use your own applications to test the proposed choice. Compare the first SIC alone with a rule that calls the second SIC only when the first returns no file. For each approach, record who would be approved or declined, which additional good and bad applicants the second report identifies, and the report cost. Then compare the added cost with the loss avoided on additional bad applicants declined and the lending value of additional good applicants approved.
Keep a no-hit separate from a failed call. A no-hit means the SIC returned no file for the applicant. A failed call means the source returned no usable response. Test both branches in the decision flow, including what your policy does when the second call also fails, before using the rule on live applications.
The data-source waterfall tool compares source options using hit rates, good and bad applicants flagged, call prices, losses and lending value. Decisimo’s data-source documentation describes general connections to REST APIs or SOAP web services and handling a failed call in the decision flow, rather than a ready-made connection to either Mexican SIC. Confirm the bureau’s interface and test its response before relying on it.
Check ownership terms before signing
The company on the contract may change during its term, so ownership is part of the commercial decision. Equifax announced an agreement to acquire Círculo de Crédito, with closing expected in the fourth quarter of 2026 subject to regulatory review and approval.
A July 2026 column reported that TransUnion held 94% of the consumer SIC after several banks sold their stakes. The same column described talks about the remaining bank stake in the business SIC as unconfirmed.
Before signing or renewing, check what your contract says happens after a change of control, including any notice or consent requirements, termination rights and possible effects on pricing, service or access to reports. That tells you what options you retain if the ownership of your provider changes.
Choose SIC contracts and prepare operations
Review the contracts. Choose one or both bureau brands according to the SIC and report coverage your lending process needs. SOFOMs meet the legal minimum with one SIC, but should confirm that the contract supplies every report they need. Confirm the relevant SIC, the report and tariff in each contract, and whether a second report adds value to your book.
- Identify whether you are assessing an individual, a company or an individual with business activity. Select the SICs that cover that borrower.
- Ask each bureau which report its contract supplies, whether it includes other SICs’ data or its own data only, and what authorised tariff applies.
- For CONDUSEF registration, SOFOMs must have a contract with at least one SIC in place. Track its expiry and submit a new or renewed contract within the required period.
- Before each pull, verify that the required signed authorisation is on file. Record its date, scope and validity, including whether it covers periodic queries during the legal relationship.
- If the report is the main reason for a decline, tell the applicant and identify the SIC that issued it.
- Report every loan where the law requires it. SOFOMs must report every loan granted to at least one SIC. When you report past-due information that qualifies for the Base Primaria de Datos, notify the customer by email or phone if you have those details.
- Before signing or renewing, check the change-of-control terms and test the value of a second report against your own applications and contract tariffs.
Questions about Mexican credit bureaus
How many credit bureaus are there in Mexico?
There are two bureau brands and three SICs. Buró de Crédito comprises a consumer SIC and a business SIC, and Círculo de Crédito is the third SIC. Compare the SICs that cover the borrower you assess.
What is the difference between Buró de Crédito and Círculo de Crédito?
Buró de Crédito has separate SICs for individuals and for companies and individuals with business activity. Círculo covers both. The law says a report includes other SICs’ data unless you request separate reports, so confirm what each contract supplies.
Do I need to sign with both Buró de Crédito and Círculo de Crédito?
No, not as a general rule. SOFOMs must have a contract with at least one SIC. Ask what report each contract supplies and what it costs before deciding whether a second contract adds value to your book.
What consent do I need before pulling a credit report in Mexico?
Where required, you need the applicant’s express authorisation, signed by hand or electronically, before the pull. It must cover the information’s nature and scope, its use and periodic queries during the legal relationship. The requirement applies to individuals and companies with total credits below 400,000 UDIS. Record the authorisation’s date, scope and validity.
How long does a default stay on a Mexican credit report?
An uninterrupted non-payment record is deleted 72 months after it was first recorded. Repeated periods of non-payment, settled agreements, credits below 1,000 UDIS and court proceedings have additional rules under the LRSIC.
What must I tell an applicant I decline because of their credit report?
If the report was the main reason for the decline, tell the applicant and provide the details of the SIC that issued it. Include that notice in your decline process.
Who owns Círculo de Crédito?
Banca Afirme, Coppel, Grupo Elektra and private investors currently own Círculo. Equifax announced an agreement to acquire Círculo, with closing expected in the fourth quarter of 2026 subject to regulatory review and approval. Check the transaction status and your contract’s change-of-control terms before signing or renewing.
