App Banamex API integration (SPEI · CoDi · OpenFinance MX)

1. SPEI auto-reconciliation for SaaS billing

Mexican B2B buyers settle invoices over SPEI rather than cards. Our service polls the customer’s Banamex SPEI inbound feed every 60 seconds, parses the concepto and referencia numerica fields and matches them to invoice IDs in your billing system. End-to-end this turns a manual back-office job into a webhook into Stripe-style "invoice paid" events.

Maps to: OpenFinance "account information service" + custom payment-event extraction.

2. Multi-bank PFM aggregation

Personal-finance and budgeting apps in Mexico need a single stream of transactions across BBVA México, Banorte, Santander and Banamex. We expose a normalised /transactions endpoint on top of Banamex with the same schema we ship for the other three, so the consumer app integrates once and serves all four issuers.

Maps to: Open Finance AIS — account information across multiple ASPSPs.

3. Credit-bureau alternative scoring

For thin-file lending in Mexico, transaction-level cash flow beats a 6-month-old bureau snapshot. We hand over 12 months of statement-derived line items — payroll inflows, fixed expenses, gambling MCCs — suitable for ingestion by a Python scoring pipeline. The flow is fully consent-driven and timestamped for SOC2-style audit.

Maps to: cash-flow underwriting (CNBV "datos transaccionales agregados" category).

4. Expense management & receipt matching

Corporate cards issued through Banamex feed a real-time card-movement webhook into expense tools (Rindegastos, Mendel, Clara). The webhook carries MCC, merchant name and amount, which we match to OCR&rsquo d receipts client-side. Card freeze/unfreeze is exposed via the same gateway so finance can stop a lost card without opening the app.

Maps to: card-issuer event API + payment-instrument controls.

5. Investment dashboard sync

Households split holdings between Banamex Inversiones, GBM+, Kuspit and brokerage apps. We pull Banamex fund positions on a daily snapshot, normalise into ISIN where possible, and emit a CSV the user’s portfolio tracker imports next morning. No screen scraping during market hours, no extra session pressure on the bank.

Maps to: wealth aggregation service / OpenInvestment.

Auth & session bootstrap

POST /api/v1/banamex/session
Content-Type: application/json
X-Client-Id: of_lab_partner_xxx

{
  "client_number": "12345678",
  "password": "<encrypted>",
  "totp": "453219",
  "device_id": "of-lab-svc-1"
}

200 OK
{
  "access_token": "eyJhbGciOi...",
  "refresh_token": "rft_...",
  "expires_in": 1800,
  "scopes": ["accounts:read","statements:read","cards:control"]
}

SPEI / movement export

GET /api/v1/banamex/transactions
?account=646180110400000007
&from=2026-04-01&to=2026-04-30
&type=SPEI&cursor=eyJwYWdlIjoyfQ==
Authorization: Bearer <ACCESS_TOKEN>

{
  "items": [{
    "id": "MX26-04-29-7841",
    "ts": "2026-04-29T10:14:33-06:00",
    "amount": -25400.00, "currency": "MXN",
    "counterparty_clabe": "012180001234567890",
    "counterparty_name": "PROVEEDOR S DE RL",
    "concept": "FACT 2026-04-127",
    "reference": "20260427",
    "fee": 0.00, "rail": "SPEI"
  }],
  "next_cursor": "eyJwYWdlIjozfQ=="
}

Card freeze webhook (server-to-server)

POST /webhooks/banamex/card-events
X-Signature: t=1714400000,v1=9b3a...

{
  "event_id": "evt_01HXY...",
  "type": "card.transaction.declined",
  "card_last4": "4421",
  "amount": 1899.00, "currency": "MXN",
  "merchant": "STARBUCKS POLANCO",
  "mcc": "5814",
  "decline_reason": "card_frozen"
}

# Reply 200 within 5s or we will retry up to 6h

Compliance & privacy

Mexican retail-banking integrations operate under the Ley para Regular las Instituciones de Tecnología Financiera (Ley Fintech, 2018). Article 76 mandates Open Finance APIs across banks, credit bureaus and clearing houses; the CNBV is the supervisory authority and Banco de México defines the technical specifications. We deliver only against the Open Data tier today (products, branches, ATMs) plus authorized customer-consented account access — no scraping of unconsented data.

For data protection we follow the LFPDPPP (Mexico’s federal personal-data law) and apply data-minimisation: only fields the customer ticked on the consent screen ever leave Banamex’ servers in our pipeline.

Data flow / architecture

A typical deployment looks like:

1. Client App — user grants consent in your UI.
2. OpenFinance Lab gateway — OAuth bridge, token vault, request signing.
3. Banamex backend — Developer Hub OpenData APIs + authorized customer endpoints.
4. Normaliser — converts MXN amounts, MCCs and CLABEs into your canonical schema.
5. Storage / Analytics — Postgres / BigQuery for transactions; Redis for short-lived balances.
6. Egress — webhook, REST, or batch CSV to your downstream consumer (ERP, BI, scoring).

Deliverables checklist

• OpenAPI 3.1 specification for every endpoint.
• Protocol & auth flow report (OAuth chain, TLS pinning notes, MFA / TOTP handling).
• Runnable source for login, statement and SPEI export — Python 3.11 and Node.js 20.
• Postman / Insomnia collection plus curl recipes for ops.
• Unit + integration test suite seeded with anonymised fixtures.
• Compliance brief: Ley Fintech mapping, LFPDPPP data-minimisation, retention guidance.

Similar fintech ecosystem & cross-bank notes

Most of our Banamex projects coexist with at least one other Mexican issuer. We keep schemas portable so a customer running Banamex today can add BBVA or Banorte tomorrow without a rewrite.

About OpenFinance Lab

We are an independent studio focused on financial-app protocol analysis, OpenData/OpenFinance integration and authorized API delivery. Our engineers come from retail banks, payment processors and mobile-app reverse-engineering backgrounds. For Mexico specifically we track the CNBV Open Finance rule-making, the Banamex Developer Hub and Banco de México SPEI/CoDi specifications, and ship end-to-end APIs that comply with the legal envelope above.

• Banking, payments, insurtech, cross-border remittance projects.
• Custom Python / Node.js / Go SDKs and test harnesses.
• Full pipeline: protocol analysis → build → validation → compliance brief.
• Source code delivery from $300 USD — runnable code + docs, pay after delivery.
• Pay-per-call API billing — access our hosted gateway, no upfront cost.

Contact

Send us the target app and a one-paragraph requirement. We will reply within one business day with a feasibility note and quote.

Open contact page

Operating hours overlap with US / LATAM business hours. Spanish and English supported.

Engagement workflow

1. Scope confirmation — which Banamex screens / data you actually need.
2. Protocol analysis and API design (2–5 business days, complexity-dependent).
3. Build & internal validation against fixture data (3–8 business days).
4. Documentation, sample clients and test cases (1–2 business days).
5. Hand-off — you keep the source, we keep the support contract.
6. Typical first delivery: 5–15 business days; third-party approvals may extend timelines.

FAQ

Does Banamex have an official Open Banking API?

What data can I extract from App Banamex through your services?

How long does delivery take and what does it cost?

Is the integration compliant with Mexican law?