How to assess a Mexican borrower's credit risk with SAT tax data
Published: September 30, 2026 · Updated: September 30, 2026
A borrower's data at Mexico's tax authority (SAT), accessed with their authorization, shows what financial statements do not always say: how much they really invoice, who they sell to, how long they take to collect, whether they are compliant with the SAT and whether they deal with suppliers on the 69-B list. It is source data, generated with third parties and hard to dress up.
Why use SAT data in credit analysis
- It is source data. Every CFDI (Mexican electronic invoice) is issued or received by the borrower and registered with the SAT; it does not depend on what the borrower reports.
- It is current. It shows operations through last month, not last year's close.
- It reaches companies with no credit history. An SME with no credit bureau record may have years of invoicing that speak for it.
- It takes minutes, with the borrower's authorization, instead of weeks of document collection.
The indicators that matter
| Indicator | Where it comes from | What it tells you |
|---|---|---|
| Invoiced revenue, last 12 months | Valid income CFDI issued | The real size of the business |
| Trend and seasonality | Month-by-month revenue | Whether it is growing, shrinking or seasonal |
| Customer concentration | Share of revenue from top recipients | Dependence on a few customers |
| Customer quality | Who the recipients are and whether they are on the 69-B list | Collection and reputational risk |
| Days to collect | Credit invoices matched to their payment receipts (complementos de pago) | How fast it actually gets paid |
| Cancellations | Share of issued CFDI later cancelled | Possible inflated invoicing or commercial issues |
| Expenses and margin | Received vs. issued CFDI | Cost structure |
| Headcount | Payroll CFDI issued | Number of employees and how it changes |
| Compliance | SAT compliance opinion and tax returns filed | Whether it is up to date with the SAT |
| Consistency | CFDI vs. tax returns | Whether it declares what it invoices |
| Counterparty risk | Suppliers and customers on the 69-B list | Exposure to simulated transactions |
| Corporate structure | Public Registry of Commerce | Shareholders, legal representatives and related parties |
Red flags
- Invoiced revenue very different from what the financial statements report.
- A single customer accounts for most of the revenue.
- Many invoices cancelled shortly after being issued.
- Credit invoices with no payment receipts: it sells but does not collect, or does not document it.
- Negative SAT compliance opinion or missing tax returns.
- Suppliers or customers on the 69-B list as presumed or definitive.
- Significant related-party transactions.
How to get the data with authorization
A taxpayer's tax information can only be accessed with their authorization. The typical flow:
- You invite the applicant from the platform or from your own system through an API.
- The applicant connects their RFC (Mexican tax ID) with their SAT password or their e.firma (advanced electronic signature) and authorizes access. You never see their credentials.
- You receive the reconciled data and indicators in a dashboard, as a PDF or directly in your loan origination system.
After disbursement: continuous monitoring
The analysis does not end at approval. With the borrower's authorization still in force, you can monitor:
- Month-over-month drops in invoicing.
- Changes in their SAT compliance opinion.
- Their appearance, or their customers', on the 69-B list.
- Rising cancellations or days to collect.
How Atlas handles it
- Applicant invitation from Atlas or through the API; connection with SAT password or e.firma, with the same scope.
- Risk profile with real revenue, customer concentration, collections, compliance, 69-B risk and corporate structure from the Public Registry of Commerce.
- Continuous portfolio monitoring after disbursement.
- Dashboard, PDF, Excel or API. See Atlas for lenders.
Request a demo and assess a real applicant.
Frequently asked questions
Is it legal to access an applicant's tax information?
Yes, with their express authorization. Without it, no. The platform should record that authorization and allow it to be revoked.
What if the applicant does not want to share their e.firma?
They can connect with their SAT password. In Atlas both options give the same scope.
Does SAT data replace the credit bureau?
No; it complements it. The credit bureau shows how a borrower repays debt; the SAT shows how the business operates.
How many months of history should I review?
At least 12 months to see seasonality, and 24 to 36 for long-term credit.
Does it work for self-employed individuals?
Yes. The same indicators apply to individuals with business activity, including those under the simplified regime (RESICO), as long as they invoice.
Can a foreign lender use this for Mexican borrowers?
Yes. The data comes from Mexican official sources with the borrower's authorization, regardless of where the lender is based. Your own regulatory requirements still apply.
This article is for information only and is not a substitute for your institution's credit policies or legal and regulatory advice.
See what Atlas finds in your RFCs.
Request a demo