Clean on OFAC. Frozen in Mexico.

The regional treasury team in Houston schedules payroll for the Monterrey plant. The transfer bounces. The Mexican bank gives a one-line explanation: orden de autoridad, an order from a government authority. Head office runs the subsidiary, its directors and its top suppliers through every sanctions list it subscribes to. Everything comes back clean.

That is exactly the problem. A frozen bank account in Mexico often has nothing to do with the lists a global compliance program checks. It can start with a Mexican list that no international database can show you, or with a routine tax request that nobody at the subsidiary answered in time.

This guide is for foreign parent companies, regional compliance teams and non-Mexican directors of Mexican entities. It explains the two routes to a freeze, how to tell them apart, and what to require from the local operation before it happens.

Why global list checks miss this

Most multinational compliance programs are built around international lists: OFAC, the UN Security Council, the EU and similar sources. Those lists matter in Mexico too. But Mexico runs its own list, and since 2026 that list can act on purely domestic grounds.

There is also a second route that has nothing to do with sanctions at all. The Mexican tax authority (SAT) can freeze the accounts of a company that fails to answer an information request about someone else’s audit.

Neither route shows up in a global dashboard. Both land on the Mexican entity’s bank accounts.

Mexico’s list is not public

The Financial Intelligence Unit (UIF), part of Mexico’s Ministry of Finance, keeps the Lista de Personas Bloqueadas(Blocked Persons List). Banks receive it and must freeze the accounts of anyone on it. The UIF’s own guidance describes the list as confidential.

In practice, this means no vendor tool, database or internal check at head office can confirm that a Mexican counterparty is not on it. You usually find out when the bank tells you, which is after the account is already frozen.

For a foreign company, that changes the question. It is no longer “have we checked this supplier?” It becomes “if this supplier is blocked tomorrow, can we prove within days that our dealings with it were legitimate?”

Blocked without a court order

For years, Mexican courts limited these blocks. Case law from 2018 held that they were constitutional mainly when they came from international commitments, such as a UN resolution or a request from a foreign authority. Thousands of blocked companies won their cases on that basis.

That changed on April 6, 2026. Mexico’s Supreme Court (SCJN) upheld Article 116 Bis 2 of the Credit Institutions Law when it decided acción de inconstitucionalidad 58/2022. The UIF can now add people and companies to the list over suspected domestic money laundering or terrorist financing, without a court order and without a foreign request.

The Court framed the block as a preventive measure, not a criminal penalty. For the company affected, the practical result is the same: the money stays frozen until the UIF is persuaded otherwise.

If your supplier, customer or business partner is added to the list, the direct freeze falls on them. The exposure for you is what comes next: payments you cannot make, contracts that stall, and a transaction history that the UIF and your own bank may start looking at closely.

The SAT route: a missed request

The second route is tax-driven, and it is the one foreign-owned subsidiaries are most likely to trip over.

When the SAT audits a company, it often asks that company’s suppliers and customers for information to cross-check the figures. Those companies are called related third parties (terceros relacionados). The request typically reaches them through the buzón tributario, the SAT’s electronic mailbox, and it is written in Spanish.

Since the 2021 reform to Articles 40 and 40-A of the Federal Tax Code (CFF), a third party that ignores these requests can have its assets provisionally attached (aseguramiento precautorio), and that includes bank accounts. The subsidiary doesn’t need to be under audit for this to happen, and it doesn’t need to owe any tax. It only needs to have stayed silent on a request about someone else.

This is where foreign ownership creates a blind spot. The mailbox belongs to the Mexican entity. If the local controller leaves, if the tax advisor changes, or if notices are treated as routine, nobody sees the request. The directors abroad hear about it only when treasury calls about a bounced transfer.

Capped at one-third of the deals

The attachment is not unlimited and it is not the first step. The CFF sets an order: the authority may request police assistance, then fine the company, then attach assets, and finally file a criminal complaint for disobedience.

When the attachment does happen, it is capped at one-third of the value of the transactions the third party carried out with the audited taxpayer, or of the amount the authority is trying to verify. It also only applies when the third party’s failure actually obstructs the audit of the other company.

For a subsidiary that sells heavily to one Mexican customer, one-third of a year’s sales can still be enough to stop operations.

SAT or UIF: who froze it?

The first thing to find out is which authority is behind the freeze, because the defense is completely different.

A SAT attachment is tied to a specific request, usually an unanswered one about a third party. The fix typically starts with answering the request, providing the information and asking for the attachment to be lifted.

A UIF block means someone is on the Blocked Persons List. The bank must notify the reasons for the inclusion. From the next business day, the affected person has five business days to request a hearing before the UIF. After that, there are ten business days to submit evidence and arguments, and the UIF then has fifteen business days to decide.

Five business days is a short window for a company whose decision-makers sit in another country and another language.

What to do in the first week

Ask the bank, in writing, which authority issued the order and on what basis. Check the buzón tributario the same day for any request the entity may have missed. Bring in Mexican counsel who handles both tax and AML matters, because the two routes can overlap.

Most of all, pull together the evidence file for every relationship involved: contracts, invoices (CFDI), proof of delivery, payment records and the due-diligence file on the counterparty. The company that can produce this in 48 hours is in a very different position from the one that starts gathering it after the deadline.

What head office should require

Global AML and sanctions controls are necessary, but they are not a Mexico-specific program. We made a similar point in A global AML program is not Mexico’s Article 41: a policy written at head office does not produce the evidence Mexican authorities ask for. Three controls close most of the gap described here:

• A named owner for the buzón tributario, with a documented weekly review and escalation to a regional contact when any request arrives.
• A current evidence file for each material Mexican counterparty, kept in Mexico and accessible from head office, not scattered across local inboxes.
• Monitoring of the Mexican lists that are public, including the SAT’s Article 69-B list of companies issuing invoices for simulated operations. We cover that in The SAT blacklist.

This is where DÝNAMI by Cumbre Asesores fits for multinational groups. It keeps the Mexican subsidiary’s compliance record, including counterparty files, CFDI support and list checks, in one traceable place that a regional compliance team can review directly instead of depending on a chain of local emails. When a Mexican authority asks for proof, the file already exists, and head office can see it too.

A confidential list cannot be checked in advance. What you can control is how fast you can prove that your dealings were legitimate.

Frequently asked questions

Can a Mexican bank freeze my account if I am not on any international sanctions list?
Yes. The UIF can add people and companies to Mexico’s Blocked Persons List for suspected domestic money laundering or terrorist financing, and the Supreme Court confirmed this power in April 2026. The SAT can also attach the accounts of a company that ignores information requests about another taxpayer.

Can I check whether a Mexican supplier is on the Blocked Persons List?
No. The UIF treats the list as confidential. Banks receive it, but it is not published, so no external tool can confirm a counterparty’s status.

Does the UIF need a court order to block an account?
No. On April 6, 2026, the Supreme Court upheld Article 116 Bis 2 of the Credit Institutions Law, which lets the UIF include people on the list on domestic grounds without a court order or a foreign request.

How much can the SAT attach from a third party?
Up to one-third of the value of the transactions the third party carried out with the audited taxpayer, or of the amount the authority is trying to verify.

How long do I have to challenge a UIF block?
Five business days, starting the business day after the bank notifies you of the reasons, to request a hearing before the UIF.

This article is for general information and does not replace professional advice on a specific case. The laws cited reflect their text in force as of September 2026.