You Are Not a Regulated Entity. Mexico's New AML Rules Still Reach You.

In short

Between July 2025 and August 2026 Mexico rewrote all three layers of its anti-money-laundering regime: the statute, its implementing regulations, and the operating rules. Public discussion has focused on who was added to the list of Vulnerable Activities.

For a foreign group holding or operating in Mexico, that is the wrong question. The group is usually not on the list, and the reform reaches it anyway — through three routes that have nothing to do with what it manufactures or sells.

Start where the analysis usually stops

A manufacturing, export or nearshoring group does not conduct a Vulnerable Activity by manufacturing. It is not a regulated category, and a compliance officer who checks the list will correctly conclude that the company is outside it.

The exposure arrives sideways, by three routes.

First, the beneficial owner of the parent. The obligation to identify it does not sit with the group. It sits with the regulated counterparties the group transacts with — the landlord, the notary, certain professional service providers. But the information those counterparties must document is not in Mexico. It is at headquarters, in another language, under another compliance function.

Second, the vehicles. The trusts and special-purpose companies used to hold land and industrial buildings are inside the regime even when the operating company is outside it. Most groups have at least one.

Third, the group-policy rule. Once any entity in the group is regulated, its AML policies stop being that entity's own business.

None of the three is detected by reviewing what the company does. They are detected by reviewing how it is held. Which is why a diagnostic that begins and ends with “am I a Vulnerable Activity?” answers a question the reform has largely moved past.

1. The list, and what the list does not tell you

Article 17 of the Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita — the LFPIORPI — enumerates the Vulnerable Activities. Each carries its own threshold, expressed in UMA, the Unidad de Medida y Actualización published by INEGI. The daily value is MX$117.31 as from 1 February 2026, and it is reset every February.

Reaching the threshold triggers the duty to identify the client. A higher threshold triggers the duty to report the transaction to the Financial Intelligence Unit of the Ministry of Finance.

One change to the thresholds has gone almost unremarked, and it matters more than the list of categories. Before the reform every threshold in Article 17 was expressed in salario mínimo — the minimum wage of the former Federal District, a reference that stopped being used to index legal amounts years ago. The reform converted all of them to UMA. That is not a drafting refresh: thresholds anchored to a frozen reference had been drifting upward in real terms for years, and converting them to an index that moves every February reactivates them. A company that concluded in 2020 that it sat below the threshold should redo that arithmetic.

The categories that matter most to a foreign investor:

• Real estate development, sale and brokerage — from 8,025 UMA, or MX$941,413 per transaction (art. 17, sections V and V Bis).

• Trusts and analogous vehicles holding or administering assets, which the new regime regulates directly.

• Notarial and professional services tied to real estate and corporate transactions.

• Lending and credit.

• Virtual asset exchange, custody and transfer — reporting from 210 UMA, or MX$24,635, per transaction (art. 17, section XVI). This category is not new: it was already in the statute before the reform. What changed is the unit the threshold is expressed in.

• High-value goods: vehicles, art, jewellery and precious metals.

On the figures. The statutory thresholds are set in UMA, not in pesos and not in dollars. The peso amounts above are the threshold multiplied by the current daily UMA, and they move every 1 February. We have deliberately not tabulated dollar equivalents, because they depend on the day's exchange rate and turn a verifiable figure into one that expires. For orientation: at roughly 17 pesos to the dollar, the real estate threshold is on the order of US$55,000 — but recompute it at the rate on the day you need it, not the day this was written.

2. Three instruments, and why that matters more than it sounds

The regime rests on three layers, and all three moved within thirteen months:

Three instruments rather than one has a practical consequence. An obligation can exist in the statute since July 2025 while the way to evidence compliance with it is only defined in rules published in August 2026. Complying with the statute and not with the rules stops being sufficient on the calendar below — and a group that read the statute in 2025 and closed the file has a gap it does not know about.

3. The calendar

• Already in force: the statute's core obligations — beneficial owner identification, appointment of a compliance officer, and reporting within 24 hours of the moment knowledge or suspicion arises (article 18, section VI) — since July 2025.

• 30 November 2026: the General Rules enter into force. Their first transitory article reads “El presente Acuerdo entrará en vigor el treinta de noviembre de dos mil veintiséis, salvo las excepciones previstas en los siguientes artículos transitorios.” Everything below is one of those exceptions.

• 1 March 2027: risk methodology operating, Internal Policies Manual updated to the new content, per-client risk classification, transactional profile, and enhanced beneficial owner identification.

• 30 May 2027: beneficial owner data updated for entities already registered in the virtual asset categories.

• 1 June 2027: automated monitoring systems operating.

• Calendar year 2027: first mandatory annual training cycle.

• Calendar year 2028: first period subject to the annual compliance audit — with the audit report itself due in 2029.

On the sourcing of this calendar. The 30 November 2026 entry into force is the Acuerdo's own first transitory article. The phased dates below it are drawn from the transitory articles as reported by four independent Mexican compliance and law-firm sources, which converge on the same dates; we have read the operative articles of the Acuerdo in the official DOF text but the transitory articles fall outside the portion we were able to retrieve. Treat the phased dates as reliable for planning and verify the specific one that governs your obligation before you rely on it in a filing.

The date that governs is none of these. The new regime is evidenced by proof that controls operated, not by the existence of a manual. A group that starts in January 2027 will have documents and no history — and history is what an audit examines.

4. The beneficial owner threshold was halved

The statute defines the beneficial owner — beneficiario controlador — by control, and control exists where a person can, in the alternative:

(i) impose decisions in shareholders' meetings or equivalent bodies, or appoint or remove a majority of the directors or administrators; (ii) hold rights allowing the exercise of voting rights over more than 25% of the capital stock; or (iii) direct the administration, the strategy or the main policies of the company.

The percentage is limb (ii). The prior figure was more than 50%.

Halving it does not recalibrate a form; it changes who appears in the file. Minority foreign shareholders previously outside are now inside, and the whole ownership chain up to the ultimate parent comes with them.

And read limbs (i) and (iii) before you build the map. They carry no percentage at all. A shareholders' agreement granting board appointment rights, a veto over reserved matters, or de facto direction of strategy makes a person a beneficial owner at 10%, or at nothing. An exercise that chases only percentages will miss people the statute reaches — and in joint ventures and minority co-investments that is the normal case, not the exception.

For a Mexican subsidiary of a foreign group this is the operational problem, and it is worse than it looks:

The information is not in Mexico. It is at the parent, in another language, held by a compliance function with its own approval process. Assembling it takes weeks, not days.

And it will be requested repeatedly. Not once, by one authority — but by every regulated counterparty the group deals with, each maintaining its own file, each on its own review cycle. A group that cannot produce this quickly does not fail an inspection; it slows down a lease, a closing or a financing, and usually at the worst moment.

Where the chain runs through offshore holding vehicles, allow considerably more time. Documenting voting control through two or three jurisdictions, in a form a Mexican regulated party will accept, is a project with its own timeline. It is the single most common reason we see a Mexican closing slip.

5. Group policy no longer stops at the border

Where the regulated entity forms part of a corporate group, its AML policies must extend to all majority-owned subsidiaries, “including foreign ones” (art. 18, section VIII).

A Mexican subsidiary's compliance programme can no longer live in isolation from the rest of the group.

And the direction of travel is the part groups get wrong. This is not the parent imposing its global policy downward. It is the regulated Mexican entity pulling the group toward the Mexican standard. For a group that already has a global AML policy, that requires a reconciliation exercise — establishing which standard governs where the two differ — and almost no group has done it.

6. What non-compliance costs

Fines are set in UMA and escalate with severity:

Read the third row twice. For serious breaches the UMA ceiling stops being a ceiling: if 100% of the transaction value is greater, that is the figure. On a real estate transaction the fine can exceed the table by orders of magnitude. A four-hundred-million-peso development does not carry an exposure of seven and a half million. It carries one of four hundred.

That is the row that changes how a board reads this.

7. The valve: correcting before you are asked

The regime rewards spontaneous correction. Correcting before an audit begins can waive the penalty entirely the first time, and a breach self-reported later can be reduced by up to 50%.

That changes the calculation for an entity that discovers it should have been registered and is not. Waiting to see whether anyone asks is, by the statute's own design, the most expensive option available.

What to do

1. Review the structure, not the business. Identify which of your Mexican entities — operating company, trust, real estate vehicle — conducts a Vulnerable Activity under Article 17. The answer is rarely the operating company.

2. Map the beneficial ownership chain against the 25% threshold, through to the ultimate parent and including minority holders. This takes the longest and gets deferred the most.

3. If the chain runs through offshore vehicles, start now. See section 4.

4. Reconcile group policy with the Mexican standard, not the other way round.

5. Prepare or update the Internal Policies Manual with room before March 2027. The constraint will not be your team; it will be advisers and providers as the date approaches.

6. Budget the automated monitoring system (June 2027) and the first annual audit (2028) in this planning cycle. They are prior-year costs, not same-year costs.

7. If an entity should be registered and is not, register it and correct spontaneously. See section 7.

What remains open — stated plainly

We have not verified against primary source the operational detail of registration itself: before which authority it is filed, what accompanies the filing, and how long an entity takes to be enrolled. For any foreign group this is the first operational question, and this guide does not yet answer it.

The deadline for the Internal Policies Manual is ninety calendar days. Article 18, section VIII of the statute requires the Manual to be prepared and observed but fixes no period; the period is in the General Rules, article 37, which requires that a person carrying out a Vulnerable Activity have the Manual “a los noventa días naturales de alta y registro” — ninety calendar days from enrolment in the register. That obligation becomes enforceable when the Rules enter into force on 30 November 2026, and the Manual's new required content is due 1 March 2027. Ninety calendar days, not business days: the count does not pause for weekends or holidays.

And there is an asymmetry worth naming. Article 18, section VI has required the report within 24 hours of the moment knowledge or suspicion arises since July 2025 — and the trigger in that text is knowledge, not a completed transaction. The methodology by which suspicious conduct is identified only becomes mandatory on 1 March 2027. There is a window of roughly twenty months in which the duty to detect runs ahead of the duty to have the system that detects. We would rather flag that than present the calendar as coherent.

Companion analysis

Does your structure touch Mexico's AML regime?

We map beneficial ownership chains, vehicles and group-policy obligations before a counterparty asks — with fixed, transparent fees.