If you invest or operate through a Mexican company, one question now sits at the center of compliance: who is the beneficial owner in Mexico behind the entity you deal with? Since July 2025, the answer has to reach the actual human being who profits or controls — never a holding company, never a nominee. If you already mapped your KYC file, this is the layer underneath it.
The stakes are not abstract. Mexico is currently under the Fifth Round of Mutual Evaluations by GAFILAT and the FATF, whose assessors began their on-site visit in March 2026. In other words, an international examiner is measuring whether Mexican controls actually work in practice — and the controlling beneficiary is the first thing they probe.
The new 25% rule
The reform to the LFPIORPI was published in the Diario Oficial on 16 July 2025 and took effect the next day. Its regulation was then updated on 27 March 2026, the first change since 2013.
The headline shift is simple. For vulnerable activities, the ownership threshold that triggers identification of the controlling beneficiary dropped from 50% to 25%. So more people now qualify. A partner who holds a 25% stake — directly or indirectly — must be identified, documented, and screened. Effective control counts too, even without that percentage.
Why 25% redraws
A lower threshold sounds like a small edit. In practice, it pulls minority partners and intermediate layers into scope for the first time.
Consequently, structures that used to stay anonymous no longer can. The law now targets the natural person in the last layer — the one who ultimately decides or collects the economic benefit. Complex holdings, opaque trusts, and nominees (“prestanombres”) are exactly the patterns the reform aims to break.
Natural person
Here is a point foreign investors often get wrong. Under the LFPIORPI, the controlling beneficiary can only be a natural person, or a group of them. A legal entity can never occupy that slot.
Therefore, if your ownership chart stops at another company, you have not finished the analysis. You must keep tracing upward until you reach the individuals who benefit or control. For legal persons and trusts, official supporting documentation is mandatory — not a declaration alone.
Trusts
Trusts deserve their own note, because this is where investors lose visibility. The obligation is not satisfied by naming “the trust.”
Instead, you must break out every participant: the settlor (fideicomitente), the trustee (fiduciario), the beneficiaries (fideicomisarios), the technical committee, and any protectors. Each one is screened. Miss one, and the file is incomplete — which the authority reads as a control failure, not a clerical slip.
PEPs: scrutiny, not suspicion
The second front is the Politically Exposed Person (PEP). The 2026 regulation added a dedicated PEP chapter, aligning Mexico with FATF Recommendation 12 — the same standard behind the UK’s MLRs, the EU’s AMLD, and FinCEN’s CDD Rule. So if you already run PEP controls at home, this will feel familiar.
Crucially, PEP status is preventive. It does not accuse anyone of a crime. It simply triggers a higher level of scrutiny, because prominent public roles carry an inherent risk of corruption or diversion of public funds.
Foreign vs. domestic PEPs
The standard treats these differently, and the distinction matters operationally.
A foreign PEP is always treated as high risk, so enhanced due diligence is mandatory. A domestic PEP — or an official of an international organization — is assessed on a risk-sensitive basis; enhanced measures kick in when the risk is high. When in doubt, most cross-border investors apply the strictest standard consistently, and that is the safer posture in Mexico too.
The four EDD steps to run
When a counterpart is a PEP, normal due diligence is not enough. FATF Recommendation 12 sets four additional measures, and Mexican supervisors expect all four:
- A risk-management system that flags whether a customer or beneficial owner is a PEP.
- Senior-management approval to open or continue the relationship.
- Reasonable measures to establish source of wealth and source of funds.
- Enhanced ongoing monitoring of the relationship — not a one-time check.
Family and close associates too
This is the trap that catches sophisticated structures. Illicit public funds rarely flow through the official directly.
Rather, they move through spouses, children, front-people, and business partners. For that reason, the same enhanced scrutiny extends to a PEP’s family members and close associates. Strictly speaking, they are not PEPs themselves — they are “associated persons” subject to equivalent treatment. If a shareholder in your counterpart is the sibling of a sitting official, that link belongs in your risk assessment.
Map the network
All of this creates a practical problem: the data lives in scattered incorporation deeds, PDFs, and spreadsheets, and it goes stale the moment someone takes office or lands on a list. Manual review cannot keep up.
This is where DÝNAMI by Cumbre Asesores does the heavy lifting. Its satellite Contacts module maps the full ownership tree — partners, attorneys-in-fact, and controlling beneficiaries — as an interactive network rather than isolated records. A natural person is identified once and then linked to every company and account in the group where they hold a stake.
From there, DÝNAMI screens that entire network continuously against global and local lists — OFAC, UN, EU, UK, PEP databases (World-Check, LexisNexis, Dow Jones), and article 69-B of the CFF. If a beneficial owner later assumes public office, or a historically “clean” partner appears on a list, the platform fires an alert across every linked account and preserves the decision in an unalterable log. That log is exactly the evidence the SAT asks for.
What the SAT test
Supervision has shifted. The authority no longer checks whether your file contains documents; it checks whether your model actually detects opaque or indirect risk through the real owners.
So the question at audit is behavioral, not documentary: did your system catch the layered structure, screen the whole network, and document who approved each exception, and when? A static folder will not answer that. A living, traceable record will.
March 2027
The identification of controlling beneficiaries and PEPs is not a “someday” item. It belongs to the first enforceable phase, whose documental and governance framework must be formalized by 1 March 2027. The automated monitoring mechanisms follow on 1 June 2027.
Because each phase requires months of prior diagnosis and process design, the practical deadline is already here. If you operate in Mexico, the time to map your beneficial owners and stand up PEP screening is now — well before the examiner asks to see it work.
FAQ
Who counts as a beneficial owner in Mexico?
The natural person (or group of natural persons) who ultimately benefits from or exercises effective control over a company or trust engaged in vulnerable activities. Since July 2025, holding 25% or more of capital or voting rights — directly or indirectly — is enough to qualify.
Is the LFPIORPI beneficial owner the same as the CFF one?
No. Mexico runs two independent regimes. The tax code (CFF) has its own beneficial-owner rules and thresholds for tax purposes, while the LFPIORPI governs anti-money-laundering obligations for vulnerable activities. Both coexist, and each must be complied with on its own terms.
Does being a PEP mean we cannot do business with them?
No. A PEP classification is not a prohibition or an accusation. It triggers enhanced due diligence: senior-management approval, source-of-funds review, and enhanced ongoing monitoring.
Do PEP rules apply to family members?
Yes, in effect. Family members and close associates receive equivalent enhanced scrutiny, because illicit funds are frequently routed through connected parties.
How long must we keep the records?
Ten years, per the LFPIORPI. Documentation must be kept current, not just archived.
This article is informational and does not constitute legal or tax advice. Obligations depend on each entity’s specific activities and structure. Verify the current text of the LFPIORPI, its regulation, and applicable general rules, and consult a qualified compliance professional before acting.