On June 30, 2025, the Mexican Congress approved, without modifications, the bill amending and supplementing various provisions to the Federal Law for the Prevention and Identification of Operations with Resources of Illicit Origin (Ley Federal para la Prevención e Identificación de Operaciones con Recursos de Procedencia Ilícita “LFPIORPI”), and reforms article 400 Bis of the Federal Criminal Code (Código Penal Federal,“CPF”). This reform stems from the initiative introduced bySenator Javier Corral Jurado in October 2024 (the “Reform”). The Reform was published on July 16, 2025, in the Federal Official Gazette (Diario Oficial de la Federación) and entered into force on July 17, 2025, except for certain provisions that are subject to specific effective dates as stated in the decree. 

This Reform is part of a direct response to growing international pressure regarding anti-money laundering and counter-terrorism financing (“AML/CFT”), in a complex geopolitical environment shaped by recent events that have highlighted the Mexican financial system’s exposure to operational, reputational, and compliance risks in relation with international standards. These events include: (i) the designation of Mexican cartels as Foreign Terrorist Organizations by the U.S. government; (ii) FinCEN orders designating CIBanco, Intercam, and Vector as institutions of primary money laundering concern in relation to opioid trafficking; (iii) the managerial intervention ordered by Mexico’s National Banking and Securities Commission (Comisión Nacional Bancaria y de Valores, “CNBV”) for those institutions; and (iv) the upcoming fifth evaluation of the Financial Action Task Force (“FATF”), which will focus on the effectiveness of Mexico’s AML/CFT system.

The Reform establishes a new comprehensive approach to strengthen the prevention, detection, and investigation of transactions involving illicit proceeds and terrorism financing. The Reform introduces a series of significant changes, the most noteworthy of which include:

1. Expansion of the Scope of the LFPIORPI 

The Reform expressly incorporates as a purpose of the LFPIORPI the collection of information useful for the investigation and prosecution of terrorism financing, placing it on equal legal footing with money laundering as a central objective of the preventive regime. This reinforces Mexico’s alignment with FATF standards, which requires the formal and operational inclusion of terrorism financing as a core component of the anti-money laundering system.

2. New Key Definitions 

The Reform introduces and redefines key concepts that expand the scope of the compliance regime and require a review of policies, procedures, and criteria for customer and transaction identification. Among the incorporated concepts, the following stand out: 

(i) Beneficial Owner: It introduces a more precise and robust definition of the beneficial owner, aligned with international standards, with the goal of strengthening the identification of the individual who, either directly or indirectly, exercises effective control or receives economic benefits from an operation. This definition extends to all vulnerable activities, making its identification and reporting mandatory in each case. 

One of the most significant changes is the lowering of the shareholding threshold used to determine effective control:, from more than 50% to more than 25%, in accordance with global practices. Additionally, legal equivalence is established between the terms “beneficial owner” (beneficiario final), “ultimate beneficial owner” (propietario real), and “ultimate beneficial owner” (propietario real), in order to unify criteria and facilitate their application within the framework of combating money laundering and terrorism financing. 

(ii) Politically Exposed Person (“PEP”): The definition of PEP is incorporated, imposing enhanced due diligence measures for those who establish commercial relationships with this type of clients. From this inclusion, subjects who perform vulnerable activities will be obligated not only to identify and monitor operations performed by PEPs, but also to establish clear internal policies, integrated into specific manuals, as well as to implement automated monitoring systems that allow detecting risks and preventing the use of the financial system for illicit purposes.

(iii) Client or User: Identification criteria are specified, establishing the obligation to review operations even when no formal contractual relationship exists. 

(iv) Compliance Representative: Established as a mandatory figure, who must have operational independence and specialized knowledge. 

(v) Risk: A legal definition of the concept of “risk” is incorporated, which is recognized as a cross-cutting pillar of the prevention regime. Risk is understood as the probability that vulnerable activities will be used for illicit purposes, and its inclusion seeks to provide a clear basis for the proportional application of obligations according to the level of exposure or identified threat. This promotes a more strategic and tailored approach in the implementation of preventive measures, aligned with the specific risk profile and level associate with each transaction or client.

3. Expansion of Vulnerable Activities in the Real Estate Sector 

The Reform includes new vulnerable activities that directly impact the real estate sector: 

(i) Incorporation of real estate development as a vulnerable activity: Section V Bis is added to article 17, establishing as a reportable activity the receipt of resources destined to develop real estate projects for sale or rental purposes (recepción de recursos destinados a desarrollar proyectos inmobiliarios con fines de venta o renta). This new provision expressly incorporates pre-sale operations and any form of financing related to such projects within the scope of the preventive regime, provided they exceed the threshold of 8,025 UMAs (approximately MXN $907,948.50 in 2025). 

(ii) Expansion of the vulnerable activity of construction: The amendment to section V of article 17 extends its scope to include not only the provision of services, but also the direct performance of construction or real estate development activities. This implies that not only contractors or service providers will be subject to the regime, but also those who directly execute projects on their own behalf, significantly expanding the range of obligated parties beyond the traditional model. 

(iii) Obligations related to the Beneficial Owner: Developers operating through corporate structures will be required to identify and report their Beneficial Owners based on the new 25% ownership threshold. This obligation is particularly relevant for projects structured through special purpose vehicles (SPVs) or complex corporate arrangements, common in real estate and hotel developments, where multiple partners or institutional investors are involved.

(iv) New operational obligations for developers: As real estate developers are now included within the regime of vulnerable activities, they must comply with all obligations set forth in Article 18 of the LFPIORPI. This includes, among others, the submission of notices and reports to the authority, the preparation of an Internal Policy Manual that defines compliance criteria and procedures, as well as the implementation of automated mechanisms that allow continuous monitoring of acts or operations performed with clients or users.

4. Strengthening of general obligations for those engaged in vulnerable activities 

The Reform reinforces the regulatory framework applicable to individuals and legal entities that carry out vulnerable activities, that is, those who are not part of the traditional financial system but who, due to the nature of their operations, are subject to AML/CFT obligations.

(i) Entities are now required to implement automated systems for continuous monitoring of transactions, aimed at detecting operations that deviate from a client’s usual transactional behavior. In addition, periodic risk assessments must be conducted using a Risk-Based Approach (RBA), allowing preventive measures to be tailored according to the level of exposure to potential transactions involving illicit proceeds.

(ii) Entities engaged in vulnerable activities must comply with the obligation to identify and directly know their clients or users, using official documents or valid forms of identification. For individuals or trusts, a formal declaration must be obtained regarding the existence or absence of a Beneficial Owner, along with the corresponding supporting documents, all in accordance with applicable general rules.

(iii) The scope of the obligation to report suspicious operations is expanded, establishing that not only transactions that have been completed must be reported, but also those that have been attempted, even if they have not been finalized. This measure seeks to strengthen the early detection capacity of possible illicit acts. Additionally, a maximum period of 24 hours is established for the submission of such reports, once the corresponding operation has been detected.

(iv) In the case of virtual asset commercialization, such as cryptocurrencies, its scope is expanded to expressly include operations performed from abroad with Mexican citizens, even when they are carried out from other jurisdictions.

(v) Regarding virtual asset commercialization, the threshold for notice submission is reduced, going from 645 to 210 UMAs per operation, which represents a decrease from approximately $72,900.00 to $23,700.00 pesos. Additionally, a new obligation is incorporated to report those operations in which a service commission equal to or greater than 4 UMAs (around $452 pesos) is charged, regardless of the total amount of the operation. 

(vi) Extension of the document conservation period from 5 to 10 years. 

(vii) Classification of risk level as criteria to determine whether supervision will be internal or through external audit.

(viii) Harmonization of obligations between sectors (for example, public brokers and notaries), eliminating unjustified differences.

(ix) Expansion of the powers of the Ministry of Finance and Public Credit (Secretaría de Hacienda y Crédito Público, “SHCP”), for proportional review according to the size and profile of the obligated subject. 

5. Registration and Reporting Obligations for Issuing Companies 

Commercial entities will be subject to new obligations that directly impact their corporate and financing structures.

(i) Mandatory registration with the SHCP: Commercial entities will be required to register with the SHCP the necessary information to identify their Beneficial Owner whenever there is a transfer of ownership or the establishment of rights over equity interests or shares. 

(ii) Notices for corporate transfers: Commercial entities must submit notices to the SHCP in the event of a transfer of ownership or constitution of any type of rights over equity interests or shares. This obligation may cover various corporate operations, such as the constitution of pledges on shares as guarantee for financing, the assignment of rights in corporate restructuring processes, or the transfer of social parts in business acquisitions. 

(iii) Collaboration with state authorities: Companies and civil associations will be required to identify their Beneficial Owner and provide such information to the competent authorities of federal entities, when required in the exercise of their powers. 

6. Strengthening of interinstitutional collaboration 

The Reform strengthens interinstitutional collaboration by establishing that all dependencies and entities of the Federal, state, and municipal Public Administration, as well as autonomous organizations, state productive enterprises, political parties, unions, and energy sector regulatory entities, will be required to provide the SHCP with any information, data, images, or documents to which they have access, when required in the context of AML/CFT-related investigations. This obligation seeks to facilitate more efficient integration of financial intelligence from multiple public sector sources. Furthermore, the SHCP will also be required to create and maintain a list of PEPs. To this end, public entities must submit their own records to contribute to the development of a reliable and up-to-date national.

7. CPF Reform 

The Reform substantially modifies the regime of criminal proceedings for offenses involving transactions with illicit proceeds:

(i) It is clarified that the Public Prosecutor’s Office is at all times empowered to investigate conduct involving the use of financial system services, conceptually distinguishing the investigative phase from the indictment. 

(ii) The requirement for prior complaint from the SHCP, through the Financial Intelligence Unit (Unidad de Inteligencia Financiera, “UIF”), is maintained for bringing criminal charges. However, under the Reform, the UIF is expressly recognized as a victim or offended in money laundering crimes, especially when illicit operations involve the use of the Mexican financial system. Likewise, the SHCP is legally recognized as a legitimated subject (with the status of victim or offended party) to act in these cases, in accordance with the Article 400 Bis of the CPF.

8. Adjustments to Notarial and Fiduciary Practice 

(i) It is established that compliance with obligations in trusts and other legal structures may fall on both the trustor and the administrator, depending on the nature of the instrument, thus extending responsibility. 

(ii) The treatment between notaries, brokers, and other legal figures subject to reporting obligations is harmonized.

9. Sanctioning Regime 

(i) The possibility of recurring voluntary regularization is introduced, removing the previous limitation that allowed it only once. It is established that, in the case of a first-time spontaneous regularization, no penalties will be imposed. For subsequent infractions, if the correction is made voluntarily and prior to the initiation of any verification procedure, a reduction of up to 50% in the applicable fines may be granted. 

(ii) The Reform to Article 62 of the LFPIORPI introduces relevant changes to the sanctioning regime. First, the requirement of intent to sanction the modification or alteration of data in mandatory notices is eliminated, allowing the crime to also be configured negligently, provided there is a vincible error of type that is spontaneously corrected before the authority becomes aware. Second, a new commission assumption is incorporated, establishing that the delivery of illegible documents or images that prevent effectively knowing their content will be equally sanctionable, thus reinforcing the requirement of quality and veracity in the information provided and closing spaces for negligence or simulation in compliance with these obligations.

10. Risk-Based Approach and Proportionality 

The Reform introduces the principle of proportionality in various provisions: 

(i) The intensity of obligations and supervision will depend on the risk profile of the obligated subject. 

(ii) It is authorized that subjects of low or medium risk may opt for internal reviews, and only in case of high risk will external verification be required. 

(iii) A flexible framework is established for the design and implementation of compliance programs adjusted to the size, complexity, and level of exposure of the obligated party.

11. Training Requirements 

(i) The Compliance Representative must annually receive training for compliance with the obligations established by LFPIORPI, in accordance with general rules issued by SHCP. 

(ii) During the first six months from the Reform’s entry into force, UIF in coordination with the Tax Administration Service (Servicio de Administración Tributaria) will implement a training and orientation program directed to nonprofit associations and companies, for correct compliance with obligations established in fractions VII to XI of Article 18 of LFPIORPI.

The implementation of the Reform demands an immediate response from both obligated subjects and individuals and legal entities who perform vulnerable activities. These entities must comprehensively review and adjust their compliance programs to align with the new regulatory standards. Specifically, it will be necessary to update client identification processes (KYC), apply more precise risk segmentation criteria, and establish automated mechanisms for continuous monitoring of transactions. 

An operational priority will be to strengthen the management of relationships with PEPs, through specific controls, additional validations, and enhanced due diligence policies. Entities exposed to this type of profiles must review and strengthen their processes to comply with new regulatory requirements.

Furthermore, vulnerable activities, such as those developed by construction companies, lessors, real estate companies, or nonprofit associations, will face new documentary and operational obligations, which will require investments in compliance infrastructure, as well as the review of their filing and internal control systems to ensure operation traceability, information conservation for at least ten years, and timely and correct submission of notices to the competent authority. The Reform also imposes on entities the obligation to maintain high standards in the capture, validation, and transmission of information, minimizing material or technical errors in notices and reports submitted.

Regarding the sanctioning system, the Reform introduces a clearer and more flexible framework of spontaneous regularization. Unlike the previous regime that allowed a one-time self-correction without delimiting whether it was for one or several operations, the Reform allows recurrent regularizations, which provides greater legal and operational certainty to obligated parties. In this context, it is recommended that entities preventively review their files and processes, preferably with the accompaniment of specialized advisors, and, where appropriate, timely correct irregularities to benefit from these new mechanisms and reduce their exposure to sanctioning risk.

At an institutional level, legal and compliance areas must be prepared to respond with agility and technical precision to information requirements formulated by the SHCP, within a more demanding interinstitutional collaboration framework. The quality, traceability, and timeliness of information delivered will be determining factors to avoid sanctions or additional investigations. 

Faced with this new regulatory environment, we recommend conducting an independent and comprehensive audit of the compliance system, with the objective of identifying gaps against new requirements. It is also fundamental to strengthen internal training programs, especially on topics such as beneficial owners’ identification, PEP relationship management, KYCs, risk matrix development, implementation of automated monitoring systems, development of effective internal controls, and punctual and correct compliance with reporting and notice obligations.

At Ritch Mueller, we have a specialized team in financial regulation and AML/CFT, ready to support our clients in effectively adapting to this new regulatory regime.

Visit our site www.ritch.com.mx or reach us at (+52) 55 9178 7000 | [email protected]