If you invest or operate through a Mexican company, one of your suppliers appearing on the SAT blacklist in Mexico is no longer a back-office accounting nuisance. Since the 2025 reforms, an invoice from a blacklisted vendor can move from a rejected deduction to the opening page of a criminal file — and, for anyone carrying out vulnerable activities, an anti-money-laundering exposure on top. Here is what that shift actually means, and what a foreign-owned operation has to verify before it signs.

From tax issue to crime

For years, Article 69-B of the Federal Tax Code (CFF) was read in purely fiscal terms. If a supplier landed on the definitive list, its invoices lost tax effect: the recipient lost the deduction and the VAT credit. That was the whole story.

That framing is now too narrow. The authority no longer treats an EFOS — an entity that invoices simulated operations — as a mere tax evader. It also reads it as a vehicle that launders illicit funds. So the same operation that used to be simply “non-deductible” can now trigger an unusual-activity alert and a criminal inquiry. If you already mapped your KYC file (see our guide on client identification), this is the layer that sits directly beneath it.

SAT blacklist Mexico

The SAT publishes two linked lists under Article 69-B. EFOS are the issuers of invoices with no real substance — the “shell” invoicers. EDOS are the taxpayers who used those invoices. When a supplier moves to the definitive list, its digital seal certificate (CSD) is restricted so it can no longer invoice, its name is published in the DOF and on the SAT portal, and every one of its clients is put on notice.

For a foreign investor, the practical point is uncomfortable: your Mexican subsidiary can be perfectly honest and still inherit exposure simply because a vendor it paid turns out to be a facturera.

The 30-day clock

Once your supplier is published on the definitive 69-B list, a strict window opens. As an EDOS, you have 30 business days from publication to prove the materiality of the operation or correct your tax position.

But the deadline is not the real threat. The evidence is. Thirty days is nothing if you have to reconstruct — after the fact — that a service was actually rendered: deliverables, communications, personnel, logistics, payment traceability. Companies that never built that file at the time of the transaction discover, too late, that a valid CFDI on its own proves nothing.

Fake invoice = red flag

Under the reform published in the Federal Official Gazette on November 7, 2025, the framework tightened again: invoices must back real, verifiable, existing operations, and the tax authority gained faster tools to presume and act against those that do not. Article 113 Bis punishes issuing, selling, buying or giving tax effect to false invoices with two to nine years in prison.

One precision matters for accuracy, and it is where lower-quality sources overreach. A false invoice does notautomatically equal “organized crime.” The 2019 attempt to route these conducts through the organized-crime regime was struck down by the Supreme Court in 2022. What is in force today is the constitutional reform to Article 19 (late 2024), which places “any activity related to false tax receipts” in the catalog that carries mandatory pre-trial detention. The distinction is real, and stating it correctly is precisely what separates authoritative compliance content from alarmist noise. Separately, the conduct can be pursued as money laundering under Article 400 Bis of the Federal Criminal Code, which is prosecuted in parallel to the tax offense.

Examiners are watching

None of this is happening in a vacuum. Mexico is under the Fifth Round of Mutual Evaluations by GAFILAT and the FATF, whose assessors began their on-site work in 2026. Examiners are not measuring whether the law exists on paper; they are testing whether obligated parties actually screen their counterparts and act on what they find. For a multinational, that means your Mexican entity’s supplier controls are, indirectly, part of how the country is graded — and how your own headquarters will be asked to answer for the jurisdiction.

The supplier base

Here is the operational gap most groups miss. Screening a vendor once, at onboarding, is not protection. The 69-B list is republished continuously; a supplier you cleared last year can be added tomorrow, and your exposure begins the day of publication — not the day you happen to notice.

This is the specific point where DÝNAMI by Cumbre Asesores does the work a spreadsheet cannot. Rather than a one-time check at signing, DÝNAMI continuously re-screens your entire active supplier base against each new 69-B publication and flags the moment an existing counterpart appears, so your 30-day clock starts on day one instead of during an audit. Just as important for a foreign-owned operation, it keeps a timestamped evidence trail — screening history and materiality documentation — that is ready to hand to an internal auditor, a headquarters compliance team, or a GAFILAT examiner without a scramble. The result is not more paperwork; it is the ability to prove, on demand, that you knew and that you acted.

Blocked RFC

A final consequence that foreign groups rarely see coming: the reforms also let the SAT deny federal taxpayer registration (RFC) to a legal entity when a partner, shareholder, or legal representative in its structure was previously tied to a company declared an EFOS or EDOS. In practice, a compliance failure in one vehicle can follow the same people into the next one — which makes knowing exactly who sits behind your counterparts (and your own structure) a threshold question, not a formality. Our guide on the beneficial owner rules covers that layer in full.

FAQ

Does a supplier on the SAT blacklist automatically make us criminals?
No. Appearing as an EDOS opens a 30-day window to prove materiality or correct your position. Criminal exposure arises where operations are genuinely simulated and you gave them tax effect — not from an isolated, well-documented transaction.

Is a valid CFDI enough to defend the deduction?
No. A properly issued invoice proves form, not substance. You must be able to demonstrate the operation actually happened, with contemporaneous evidence beyond the CFDI itself.

Is it enough to check a supplier’s RFC once?
No. The 69-B list changes constantly. Screening has to be continuous; a single check at onboarding leaves you exposed the day a vendor is later added.

We are a foreign company — does this apply to us?
Yes, through your Mexican operations. If your Mexican entity deducts an operation or carries out a vulnerable activity, it is subject to these rules regardless of where the ultimate parent sits.

This article is informational and does not constitute legal or tax advice. Obligations depend on each entity’s specific activities and structure. Verify the current text of the CFF, the LFPIORPI and applicable rules, and consult a qualified professional before acting.