Amendment to the General Rules under Mexico’s Anti-Money Laundering Law (LFPIORPI): Key Regulatory Changes Under Acuerdo 115/2026

Comprehensive Analysis of Key Regulatory Changes

The General Rules are directed at the prevention and detection of acts or transactions involving proceeds of illicit origin, and are intended to establish the minimum measures and procedures that must be observed by those who carry out the Vulnerable Activities referred to in Article 17 of the LFPIORPI—namely, individuals and legal entities engaged in sectors such as gaming and betting, non-bank lending, real estate development and commercialization, dealing in precious metals and stones, vehicle sales, independent professional services, notarial acts, virtual asset services, and other regulated activities, as well as trusts or any other legal vehicle through which such activities are conducted.

Building on this regulatory foundation, the amendment to the General Rules through Acuerdo 115/2026 translates these statutory mandates into actionable compliance requirements, representing the most granular layer of Mexico's reformed AML framework. The following analysis addresses each major component.

Risk-Based Approach (Chapter II Quáter)

Articles 10 Septies through 10 Septies 6 introduce a mandatory risk-based approach ("EBR" in its Spanish acronym) requiring each obligated party to develop a documented risk methodology. The methodology must be data-driven, reference the National Risk Assessment (Evaluación Nacional de Riesgos) published by the Unidad de Inteligencia Financiera ("UIF"), and incorporate indicators from Articles 139 Quáter and 400 Bis of the Federal Criminal Code. The methodology must be reviewed and updated when new risks are detected, when the National Risk Assessment is updated, or at a minimum every 12 months. All supporting information must be retained for 10 years and made available to the Servicio de Administración Tributaria ("SAT") and the UIF upon request.

Client Risk Classification (Chapter III Bis)

Articles 23 Bis through 23 Bis 4 require obligated parties to classify clients into a minimum of three risk categories: low, medium, and high (intermediate categories are permitted). Client risk must be reassessed at least every six months, with higher-frequency reassessment for higher-risk clients. The Rules mandate automatic high-risk classification for two categories: (a) non-residents linked to preferential tax jurisdictions or jurisdictions with deficient AML frameworks, and (b) foreign PEPs.

KYC and Due Diligence (Chapter III Ter)

Articles 23 Ter through 23 Ter 5 introduce transaction profiling (perfil transaccional) as a core KYC element, requiring obligated parties to establish expected parameters for each client covering transaction amounts, frequency, number of operations, and origin and destination of funds. During the first six months of a business relationship, the profile must incorporate client-declared maximum monthly volumes. Enhanced Due Diligence ("EDD") applies to high-risk clients and includes additional information collection, intensive monitoring, questionnaires on the origin and destination of funds, shareholder verification, and analysis against Secretaría de Economía electronic registries. Where a client is both a PEP and classified as high-risk, senior executive approval is required to maintain the business relationship.

Beneficial Owner Identification (Chapter III Quinquies)

Article 23 Quinquies establishes a three-tier identification protocol, applied in descending order of priority:

• Tier 1: The natural person(s) holding 25% or more of the direct or indirect shareholding or ownership interest (reduced from the prior 50% threshold).

• Tier 2: Where no person meets the Tier 1 threshold, the natural person exercising control through other means—specifically, directing, or influencing the entity's strategy or policies.

• Tier 3: Where neither Tier 1 nor Tier 2 yields an identification, the natural person holding the highest administrative position within the entity.

Identification must occur before the vulnerable activity is performed or when the business relationship is established. The obligated party must document the identification procedure, retain supporting documentation, and ensure that the information remains current.

PEP Framework (Chapter III Quáter)

Articles 23 Quáter through 23 Quáter 2 define Politically Exposed Persons to include heads of state, senior government officials, judicial and military officers, senior state-owned enterprise executives, and political party leaders—covering both domestic and foreign officials. Domestic PEP status persists for one year after leaving office. The UIF will deploy Consulta PEP 2.0, an electronic consultation tool accessible via electronic signature, within nine months of the Rules' entry into force (approximately August 2027).

Internal Policies Manual (Chapter X)

Articles 37 and 37 Bis through 37 Bis 3 require each obligated party to maintain a comprehensive Internal Policies Manual containing 14 mandatory sections: (i) identification and KYC criteria; (ii) risk classification mechanisms; (iii) due diligence procedures by risk level; (iv) PEP identification and management; (v) detection of operations deviating from the transaction profile; (vi) notice and report filing procedures; (vii) information retention protocols; (viii) transaction accumulation detection; (ix) sanctions list consultation; (x) Compliance Representative functions; (xi) training programs; (xii) internal control, supervision, and audit procedures; (xiii) confidentiality; and (xiv) manual update procedures. The Manual must be prepared within 90 calendar days of registration (alta y registro). Corporate groups must maintain centralized policies across majority-owned branches and subsidiaries, including foreign operations.

Automated Monitoring Systems (Chapter XIII)

Article 41 mandates automated monitoring systems with six minimum functions: (i) a unified identification file per client; (ii) a consolidated transaction profile capable of detecting deviations from expected behavior; (iii) input capabilities to the entity's risk methodology; (iv) a risk classification engine with at least 10 years of historical records; (v) an alert system covering high-risk clients, PEPs, persons on Article 38 restricted lists, and high-risk jurisdictions; and (vi) cash usage monitoring. Systems must be operational by June 1, 2027.

Training and Personnel Selection (Chapter XII)

Article 39 Bis requires at least one training course, workshop, or program per calendar year covering the LFPIORPI, its Regulations, the General Rules, the Internal Policies Manual, vulnerable activities under Article 17, and entity-specific risks. Trainers must possess a minimum five years of experience. Training evidence must be retained for 10 years. Personnel selection procedures (Article 39 Bis 2) must apply formal criteria and become applicable to new hires from March 1, 2027. The first annual training period runs from January 1 through December 31, 2027. Individuals and Compliance Representatives may optionally obtain UIF certification, valid for five years.

Annual Audits (Chapter XIV)

Articles 42 through 51 establish a comprehensive audit framework. Audits cover the calendar year (January 1 through December 31) and employ a five-level rating scale. Low- and medium-risk entities may conduct audits through an internal audit or control function (independent of the Compliance Representative). High-risk entities must engage an external auditor holding UIF certification, a professional title and cédula profesional, and a minimum three years of relevant experience. The audit report (dictamen) is due on the last business day of March following the audit year. The first audit period runs from January 1 through December 31, 2028 (with the dictamen due by March 2029).

Virtual Assets (Chapter II Bis)

Articles 24 Bis 2 through 24 Bis 5 refine the virtual asset framework, establishing threshold mechanics at 210 Unidad de Medida y Actualización or Unit of Measure and Update ("UMA")s per transaction or four UMAs as a service fee. Information on the originator, recipient, and beneficial owner must be retained for 10 years. Virtual asset service providers have six months from entry into force to update their Article 10 Bis information.

Sanctions and Enforcement Risks

The reformed sanctions framework significantly increases enforcement risk through both enhanced penalties and expanded grounds for liability.

Fines now range from 200 to 65,000 UMAs—at the 2026 UMA value of MXN $117.31, this translates to approximately MXN $23,462 to MXN $7,625,150 (approximately $1,200 to $385,000 USD at current exchange rates). Fines are calculated on the basis of the violation's severity, the obligated party's economic capacity, and the degree of recurrence.

Perhaps the most consequential change for enforcement purposes is the elimination of dolo (criminal intent) as an element of the criminal offense under Article 62 of the LFPIORPI for data alteration in notices. Under the prior regime, prosecutors had to demonstrate that the obligated party intentionally provided false or misleading information. The reformed provision appears to create a strict liability or negligence-based offense, substantially lowering the prosecution threshold. Obligated parties should ensure that their notice-filing procedures incorporate verification, quality control, and audit trail documentation to demonstrate due care.

The reformed Regulations grant the Servicio de Administración Tributaria or Tax Administration Service ("SAT") expanded verification capabilities, including the authority to use third-party databases maintained by other governmental authorities with a legal presumption of veracity. Obligated parties facing SAT verification proceedings based on external data have a 10-business-day window to present evidence and arguments (derecho de audiencia). Organizations should maintain comprehensive compliance records and be prepared to respond quickly to information requests, as the presumption of veracity shifts the initial burden of explanation to the obligated party.