A guide for U.S. companies with a Mexican subsidiary. The short answer: Mexico's anti-money-laundering law (the Federal Law for the Prevention and Identification of Transactions with Illicit Proceeds, LFPIORPI) was reformed by decree in the DOF of July 16, 2025, and its Regulation was reformed by decree in the DOF of March 27, 2026, in force March 28. The law reform widened the list of "vulnerable activities" and raised penalties; the regulation reform refined definitions, created a chapter on politically exposed persons and widened the supervisory powers of the UIF and the SAT. Many subsidiaries carry out a vulnerable activity without knowing it.
What changed in the law (July 2025)
- A wider list of vulnerable activities, with trusts and commercial companies as direct obligated parties in certain cases.
- Lower thresholds to identify the beneficial owner and heavier identification and monitoring duties.
- A risk-based approach: each obligated party must document how it assesses the risk of its clients and transactions.
- Higher administrative fines and adjustments to the money-laundering offense (article 400 Bis of the Federal Criminal Code).
What changed in the regulation (March 27, 2026)
- Politically exposed persons: a new chapter. The UIF will keep a list fed by public authorities, which must update it within five business days of any change; obligated parties may consult it when they cannot determine whether a client is a politically exposed person.
- Definitions: terms removed and added, among them those for the politically exposed persons list and for notaries and other public officers.
- Reports and thresholds: rules to aggregate linked transactions over periods of up to six months, and a 24-hour report for attempted transactions in certain cases.
- Record keeping: records and supporting documents for at least ten years.
- Supervision: time limits for SAT information requests and sanctions, and a procedure to self-report violations.
- The General Rules that implement the reform were still pending publication as of this guide.
Where a foreign subsidiary usually gets caught
- Real estate leasing, intercompany loans, sales of vehicles or machinery, and group treasury or asset-management services: several of these are vulnerable activities above the thresholds, even if they are not the company's line of business.
- Cash or precious-metal payments above the legal limits, prohibited in certain acts.
- Beneficial owner: the subsidiary must identify and document the individuals who control the group, under the new thresholds, and keep it available for the SAT.
- Registration in the vulnerable-activities registry, a compliance manual, a designated compliance officer and monthly reports to the UIF, where they apply.
What to check now
- Map the subsidiary's transactions against the reformed list of vulnerable activities, with the 2026 UMA thresholds.
- If any applies: registration with the SAT as an obligated party, manual, compliance officer, client and politically-exposed-person identification policy.
- A beneficial-owner file updated to the new thresholds and consistent with the one the Federal Tax Code requires.
- A reporting calendar, ten-year record keeping, and an internal procedure for the 24-hour report.
- A review of intercompany contracts and of the year's transactions to catch aggregations that cross a threshold within six months.
Frequently asked questions
My subsidiary only manufactures and exports. Does the anti-money-laundering law apply?
Manufacturing itself is not a vulnerable activity, but transactions around it can be: leasing real estate, granting or receiving loans, selling assets, or receiving cash above the limits. The transaction defines the duty, not the line of business.
What is a politically exposed person and why does it matter now?
Someone who holds or held a prominent public function, in Mexico or abroad, and their close family and associates. Since the regulation reform there is a list run by the UIF, and obligated parties must apply enhanced measures when a client falls in that category.
What are the penalties for not filing reports?
Fines the law sets in UMA units per violation, which can escalate on repeat offenses, plus criminal consequences when the conduct fits article 400 Bis of the Federal Criminal Code. The regulation's self-reporting procedure allows a company to regularize before the authority acts.
General information, updated October 2026. It does not replace legal advice for a specific case.
Request a first review
Tell us what your subsidiary does besides manufacturing or selling, and whether it is already registered for vulnerable activities. Schedule a consultation.