What Article 30-B Actually Requires
Since April 1, 2026, Article 30-B of Mexico's Federal Tax Code (Código Fiscal de la Federación) — implemented through Rule 2.9.21 of the 2026 Miscellaneous Tax Resolution, published in the Diario Oficial de la Federación on December 28, 2025 — has required digital platforms operating in Mexico to give the tax authority (SAT) continuous, direct online access to transaction-level data. Covered platforms, which range from streaming and SaaS providers to marketplaces and intermediation apps, must maintain a database of tax IDs, prices, VAT breakdowns, payment methods and withholding records, updated within a day of each transaction and retained for five years so SAT can review it on demand. Platforms had until April 30, 2026 to file formal notice with SAT — including access credentials and a technical manual — under a process known as Ficha 168/CFF. Noncompliance carries a serious penalty: SAT can order a platform's access temporarily suspended, a mechanism critics have dubbed a "kill switch" (KPMG TaxNewsFlash).
The Legitimate Case for Real-Time Reporting
Mexico's frustration is understandable. The country pioneered mandatory e-invoicing (CFDI) more than a decade ago precisely because voluntary compliance in a large informal economy didn't work, and that system is now credited internationally as one of the more effective VAT-enforcement tools in Latin America. Foreign digital platforms — streaming services, delivery apps, marketplaces — routinely under-withhold or simply don't remit Mexican VAT, and giving SAT visibility into transaction flows in near real time is a defensible extension of a reporting model Mexico already normalized domestically. Governments worldwide, from the EU's VAT e-commerce package to India's equalization levy, have concluded that platform-level reporting is the only practical way to tax a digital economy that doesn't sit still long enough for traditional audits.
Where the Design Falls Short
The problem is not the goal but the breadth of the mechanism. As Mexican digital-rights group R3D (Red en Defensa de los Derechos Digitales) argued when the reform was moving through Congress, Article 30-B authorizes "permanent, unrestricted and real-time access" to data merely "related to" a platform's digital services — language broad enough to sweep in user identifiers well beyond what VAT enforcement requires, with no judicial authorization step. R3D called it a "total, permanent and real-time invasion, without safeguards or judicial control," and drew a direct line to Article 109 of Mexico's telecommunications law, whose platform-blocking powers were previously criticized as a form of prior restraint (R3D). CSIS's Diego Marroquín Bitar reaches a similar structural conclusion from a trade-policy angle: the law establishes "no published proportionate safeguards, no independent oversight mechanism, and no clear boundaries on secondary use," which for foreign operators "fundamentally alters the risk calculation for operating in Mexico" (CSIS). A tax-compliance tool that also functions as an unbounded standing data pipe, enforceable by service suspension, is not proportionate merely because its stated purpose is proportionate.
The USMCA Collision
The timing sharpens the stakes. USMCA's Chapter 19 commits all three parties to cross-border data-flow guarantees and bars unjustified data-localization requirements. Marroquín Bitar puts the legal question plainly: "Whether Article 30B is compatible with Chapter 19's cross-border data flow commitments is an open legal question, and one that the review will almost certainly surface." That review is no longer hypothetical. On July 1, 2026, the USMCA Free Trade Commission held its mandatory joint review, and the U.S. Trade Representative stated the U.S. "did not agree to renew the USMCA in its current form," triggering an annual review process rather than an automatic extension. The week of July 20, U.S. and Mexican negotiators convened in Mexico City for a third bilateral round covering steel and aluminum, autos, economic security, labor, agriculture — and electronic payment services (USTR), a category squarely adjacent to the data flows Article 30-B implicates.
A Narrower Path
Mexico doesn't need to choose between tax enforcement and its treaty commitments — it needs to narrow the mechanism. That means restricting mandatory access to the VAT-relevant fields the rule already lists (amounts, tax IDs, withholding) rather than open-ended "related" data; requiring an independent authorization step, not standing administrative access, before SAT can pull user-identifying records; replacing platform suspension with graduated financial penalties, which achieves compliance without the prior-restraint problem R3D flags; and using the current review window to resolve the Chapter 19 question bilaterally, rather than waiting for a formal dispute. CSIS's own framing is right: preserve the core of USMCA's digital-trade chapter and build compliance tools around it, rather than let a legitimate revenue measure become the fight that reopens it.
"Permanent government access to operational data, without clear limits or judicial oversight, fundamentally alters the risk calculation for operating in Mexico." — Diego Marroquín Bitar, CSIS
Getting this right matters beyond Mexico. Every government watching the USMCA review is also watching whether "tax compliance" becomes the label under which cross-border data commitments quietly erode.