Mexico's Anti-Money Laundering Law: Are You Obligated?

Many companies assume Mexico’s anti money laundering rules only apply to banks. The don’t. The LFPIORPI reaches real estate firms and developers, lenders, jewels, car dealers, landlords and professional-service providers, among many others. If you carry out a “vulnerable activity” above certain amounts, you are an obligated party – and not knowing it won’t shield you from seven-figure fines. This guide helps you find out wether you’re in scope and what you must do.

What the AML law is

The Federal Law for the Prevention and Identification of Operations with Resources of Illicit Origin (LFPIORPI), in force since 2013 requires anyone performing vulnerable activities to identify their clients, build client files, file reports with the Treasury and retain documentation. Oversight today sits with the SAT (tax authority) and the Financial Intelligence Unit (gif). By 2026 the national registry lists more than 218,000 obligated parties.

The vulnerable activities

Article 17 sets out the activities that trigger obligations. Some of the most common:

Purchase, sale and real-estate development.
Leasing of real property.
Granting loans or credit without being a financial institution.
Sale of vehicles (new or used) and armoring.
Trade in jewelry, precious metals and stones, watches and artwork
Issuance of prepaid cards and certain services.
Certain professional and notarial services and virtual assets.

Thresholds

Each activity has two thresholds, measured in UMA (2026 value: MXN $117.31 per day):

Identification threshold: from here you must identify the client and build the file.
Reporting threshold: once exceed, you must file the report with the Treasury.

One nuance from the amended Regulation (published 27 March 2026): Article 17 thresholds are calculated without VAT, while the Article 32 cash-payment restriction does include VAT. Some operations also accumulate over six-month periods to test the threshold.

Your obligations (Article 18)

After the July 2025 reform, Article 18 sets a comprehensive regime. The essentials:

Know Your Customer (KYC) – Identify and validate client information.
Identify the beneficial owner / controlling beneficiary (the control threshold dropped from 50% to 25%).
File reports by the 17th of the following month, in XML format through the SPPLD portal. Three types exists: reports with operations, “zero” reports, and the 24-hour report when there are signs of illicit funds.
Retain documentation for 10 years (up from 5).
Adopt a Risk-Based Approach, a compliance manual, and appoint a compliance officer.
Meet enhanced obligations for Politically Exposed Persons (PEPs) and audits.

The fines

Penalties range from 200 to 65,000 UMA (roughly MXN $23,000 to $7.6 million in 2026), and in some cases 10% to 100% of the transaction value. Two worth remembering:

Failing to file a report can start at 10,000 UMA (over MXN $1.1 million).
Filing more that 30 days late is penalized at 2,000 UMA (about MXN $234,000).

There is a lifeline: Article 55 lets the authority waive the penalty once, if you regularize voluntarily before verification begins. After using it, the reduction can reach 50%.

Do it with DYNAMI

Doing this by hand – KYC files, thresholds that shift each year with the UMA, XML reports due on the 17th, screening against lists – is unworkable and risky. DYNAMI builds each client file, calculates thresholds automatically, generates the SPPLD reports and alerts you before every deadline. AML compliance stops depending on someone remembering.

Frequently asked questions

If I perform a vulnerable activity but stay under the threshold, do I have to do anything? You must monitor the threshold (including six-month accumulation). Below the identification threshold the obligation generally isn’t triggered; once you reach it, it is.

Who supervises me – the SAT or the UIF? Both. After the 2025-2026 reforms, the SAT and UIF share information-request and verification powers, with short response deadlines.

Is the AML law the same as the tax “controlling beneficiary”? They are distinct regimes that overlap. LFPIORPI uses a 25% control threshold; the Federal Tax Code requires identifying the controlling beneficiary from 15%. We cover that in its own article.

Compliance starts with knowing

Mexico’s AML law doesn’t forgive ignorance: the first step is confirming wether you perform a vulnerable activity and locating your thresholds. From there it’s process – files, timely reports, and documentation kept for 10 years. With DYNAMI at Cumbre Asesores we help companies in Mérida, Mexico City and Guadalajara diagnose their AML position and build compliance that withstands a review. If you’re unsure wether you’re in scope, let’s run the diagnostic together.